Accrediting outputs of noisy intermediate-scale quantum computing devices

Quantum computers promise to expand our computing capabilities beyond their current horizons. Several commercial institutions [1–3] are taking steps towards building the first prototypes of quantum computers that can outperform existing supercomputers in certain tasks [4–9], the so-called 'Noisy Intermediate-Scale Quantum' (NISQ) computing devices [10]. As all their internal operations such as state preparations, gates, and measurements are by definition noisy, the outputs of computations implemented on NISQ devices are unreliable. It is thus essential to devise protocols able to accredit these outputs.

A commonly employed approach involves simulating the quantum circuit whose output we wish to accredit, the target circuit, on a classical computer. This is feasible for small circuits, as well as for circuits composed of Clifford gates [11] and few non-Clifford gates [12, 13]. Classical simulations have been performed for quantum computations of up to 72 qubits, often exploiting subtle insights into the nature of specific quantum circuits involved [14, 15]. Though practical for the present, classical simulations of quantum circuits are not scalable. Worthwhile quantum computations will not be efficiently simulable on classical computers, hence we must seek for alternative methods.

Another approach employed in experiments consists of individually testing classes of gates present in the target circuit. This is typically undertaken using a family of protocols centered around randomized benchmarking and its extensions [16–21]. These protocols allow extraction of the fidelity of gates or cycles of gates and can witness progresses towards fault-tolerant quantum computing [22]. However they rely on assumptions that may be invalid in experiments. In particular, they require the noise to be Markovian and cannot account for temporal correlations [23, 24]. Quantum circuits are more than the sum of their gates, and the noise in the target circuit may exhibit characteristics that cannot be captured by benchmarking its individual gates independently.

This calls for protocols able to test circuits as a whole rather than individual gates. Such protocols have been devised inspired by Interactive proof Systems [25]. In these protocols (which we call 'cryptographic protocols') the outputs of the target circuit are verified through an interaction between a trusted verifier and an untrusted prover (figure 1(a)). The verifier is typically allowed to possess a noiseless quantum device able to prepare [26–33] or measure [34–38] single qubits, however recently a protocol for a fully classical verifier was devised that relies on the widely believed intractability of a computational problem for quantum computers [39]. Other protocols for classical verifiers have also been devised, but they require interaction with multiple entangled and non-communicating provers [40–44]. Cryptographic protocols show that with minimal assumptions, verification of the outputs of quantum computations of arbitrary size can be done efficiently, in principle.

Zoom In Zoom Out Reset image size

In practice, implementing cryptographic protocols in experiments remains challenging, especially in the near term. In experiments all the operations are noisy, as in figure 1(b), and the verifier does not possess noiseless quantum devices. Thus, the verifiability of protocols requiring noiseless devices for the verifier is not guaranteed. Moreover, the concept of scalability, which is of primary interest in cryptographic protocols, is not equivalent to that of practicality, which is essential for experiments. For instance, suppose that the target circuit contains a few hundred qubits and a few hundred gates. Cryptographic protocols require implementing this circuit on a large cluster state containing thousands of qubits and entangling gates [26–31, 34] or on two spatially-separated devices sharing thousands of copies of Bell states [40, 41]; or appending several teleportation gadgets to the target circuit (one for each T-gate in the circuit and six for each Hadamard gate) [33]; or building Feynman–Kitaev clock states, which require entangling the system with an auxiliary qubit per gate in the target circuit [35, 39, 43]. These protocols are scalable, as they require a number of additional qubits, gates and measurements growing linearly with the size of the target circuit, yet they remain impractical for NISQ devices.

In this paper we present an accreditation protocol that provides an upper-bound on the variation distance between noisy and noiseless probability distribution of the outputs of a NISQ device, under the assumption that

• N1:  
  Noise in state preparation, entangling gates, and measurements is an arbitrary Completely Positive Trace Preserving (CPTP) map encompassing the whole system and the environment (equation (2));
• N2:  
  Noise in single-qubit gates is a CPTP map ${{ \mathcal F }}_{{SE}}$ of the form ${{ \mathcal F }}_{{SE}}=(1-r){ \mathcal I }+r{{ \mathcal F }}_{{SE}}^{{\prime} }$ with $0\leqslant r\lt 1$, where ${{ \mathcal I }}_{{SE}}$ is the identity on system and environment and ${{ \mathcal F }}_{{SE}}^{{\prime} }$ is an arbitrary (potentially gate-dependent) CPTP map encompassing the whole system and the environment.

Inspired by cryptographic protocols [26–44], our accreditation protocol is trap-based, meaning that the target circuit being accredited is implemented together with a number v of classically simulable circuits (the 'trap' circuits) able to detect all types of noise subject to conditions N1 and N2 above. A single run of our protocol requires implementing the target circuit being accredited and v trap circuits. It provides a binary outcome in which the outputs of the target circuit are either accepted as correct (with confidence increasing linearly with v) or rejected as potentially incorrect. More usefully, consider running our protocol d times, each time with the same target and v potentially different trap circuits. Suppose that the output of the target is accepted as correct by ${N}_{\mathrm{acc}}\gt 0$ runs. With confidence 1 − 2exp $(-2d{\theta }^{2})$, for each of these accepted outputs our protocol ensures

$$\begin{eqnarray}&&\displaystyle \frac{1}{2}\displaystyle \sum _{\overline{s}}\left|{p}_{\mathrm{noiseless}}(\overline{s})-{p}_{\mathrm{noisy}}(\overline{s})\right|\leqslant \displaystyle \frac{\varepsilon }{{N}_{\mathrm{acc}}/d-\theta },\end{eqnarray} \tag{ 1 }$$

where $\theta \in (0,{N}_{\mathrm{acc}}/d)$ is a tunable parameter that affects both the confidence and the upper-bound, ${p}_{\mathrm{noiseless}}(\overline{s})$ and ${p}_{\mathrm{noisy}}(\overline{s})$ are the noiseless and noisy probability distributions of the outputs $\{\overline{s}\}$ of the target circuit respectively and $\varepsilon \propto 1/v$. Bounds of this type can fruitfully accredit the outputs of experimental quantum computers as well as underpin attempts at demonstrating and verifying quantum supremacy in sampling experiments [4–9].

Crucially, our accreditation protocol is both experimentally practical and scalable: all circuits implemented in our protocol are no wider (in the number of qubits) or deeper (in the number of gates) than the circuit we seek to accredit. This makes our protocol more readily implementable on NISQ devices than cryptographic protocols. Moreover, our protocol requires no noiseless quantum device, and it only relies on the assumption that the single-qubit gates suffer bounded (but potentially non-local in space and time and gate-dependent) noise—condition N2. This assumption is motivated by the empirical observation that single-qubit gates are the most accurate operations in prominent quantum computing platforms such as trapped ions [45, 46] and superconducting qubits [2, 47, 48].

In addition to its ready implementability on NISQ devices, our accreditation protocol can detect all types of noise typically considered by techniques centered around randomized benchmarking and its extensions [16–21]. Moreover it can detect noise that may be missed by those techniques such as noise correlated in time. Mathematically, this amounts to allowing noisy operations to encompass both system and environment (figure 1(b)) and tracing out the environment only at the end of the protocol. This noise model is more general than the Markovian noise model considered in protocols centered around randomized benchmarking [23, 24]. Moreover, by testing circuits rather than gates, our protocol ensures that all possible noise (subject to condition N1 and N2) in state preparation, measurement and gates is detected, even noise that arises only when these components are put together to form a circuit. On the contrary, benchmarking isolated gates can sometimes yield over-estimates of their fidelities [21], and consequently of the fidelity of the resulting circuit. We note that noise of the type N2 excludes unbounded gate-dependent errors in single-qubit gates such as systematic over- or under-rotations, as also is the case for other works [16–21].

Inspired by our accreditation protocol we also present a novel cryptographic protocol, which we call 'mesothetic verification protocol'. In the mesothetic protocol the verifier implements the single-qubit gates in all circuits while the prover undertakes all other operations. This is distinct from prepare-and-send [26–33] or receive-and-measure [34–38] cryptographic protocols in that the verifier intervenes during the actual implementation of the circuits, and not before or after the circuits are implemented.

Our paper is organized as follows. In section 1 of Results we introduce the notation, in section 2 we provide the necessary definitions, in sections 3 and 4 we present our protocol and prove our results and in section 2.5 we present the mesothetic verification protocol.

2.1. Notation

2.2. Background

We start by defining our notion of protocol:

Definition 1(Protocol). Consider a system S in the state ${\rho }_{S}$. A protocol on input ${\rho }_{S}$ is a collection of CPTP maps $\{{{ \mathcal E }}_{S}^{(p)}\}{}_{p=1}^{q}$ acting on S and yielding the state ${\rho }_{\mathrm{out}}={\circ }_{p=1}^{q}{{ \mathcal E }}_{S}^{(p)}({\rho }_{S})$.

When implemented on real devices protocols suffer the effects of noise. Modeling noise as a set $\{{{ \mathcal F }}_{{SE}}^{(p)}\}$ of CPTP maps acting on system and environment (figure 1(b)), the state of the system at the end of a noisy protocol run is

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}={\mathrm{Tr}}_{E}\left[{\circ }_{p=1}^{q}{{ \mathcal F }}_{{SE}}^{(p)}\left({{ \mathcal E }}_{S}^{(p)}\otimes {{ \mathcal I }}_{E})({\rho }_{S}\otimes {\rho }_{E})\right],\right.\end{eqnarray} \tag{ 2 }$$

where ${\rho }_{E}$ is the state of the environment at the beginning of the protocol. We allow each map ${{ \mathcal F }}_{{SE}}^{(p)}$ to depend arbitrarily on the corresponding operation ${{ \mathcal E }}_{S}^{(p)}$.

A trap-based accreditation protocol is defined as follows. A single run of such a protocol takes as input a classical description of the target circuit and a number v, implements $v+1$ circuits (the target and v traps) and returns the outputs of the target circuit, together with a 'flag bit' set to '$\mathrm{acc}$' ('$\mathrm{rej}$') indicating that the output of the target must be accepted (rejected). Formally,

Definition 2(Trap-Based Accreditation Protocol). Consider a protocol $\{{{ \mathcal E }}_{S}^{(p)}\}{}_{p=1}^{q}$ with input ${\rho }_{S}$, where ${\rho }_{S}$ contains a classical description of the target circuit and the number v of trap circuits. Consider also a set of CPTP maps $\{{{ \mathcal F }}_{{SE}}^{(p)}\}{}_{p=1}^{q}$ (the noise) acting on system and environment. We say that the protocol $\{{{ \mathcal E }}_{S}^{(p)}\}{}_{p=1}^{q}$ can accredit the outputs of the target circuit in the presence of noise $\{{{ \mathcal F }}_{{SE}}^{(p)}\}{}_{p=1}^{q}$ if the following two properties hold:

• (1)  
  The state of the system at the end of a single protocol run (equation (2)) can be expressed as

  $$\begin{eqnarray}&&{\rho }_{\mathrm{out}}=b\ {\tau }_{\mathrm{out}}^{{\prime} \mathrm{tar}}\otimes | \mathrm{acc} \rangle \langle \mathrm{acc}| +(1-b)\left(l\ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{acc} \rangle \langle \mathrm{acc}| +(1-l){\tau }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{rej} \rangle \langle \mathrm{rej}| \right),\end{eqnarray} \tag{ 3 }$$

  where ${\sigma }_{\mathrm{out}}^{\mathrm{tar}}$ (${\tau }_{\mathrm{out}}^{{\prime} \mathrm{tar}}$) is the state of the target circuit at the end of a noiseless (noisy) protocol run, ${\tau }_{\mathrm{out}}^{\mathrm{tar}}$ is an arbitrary state for the target circuit, $| \mathrm{acc}\rangle$ is the state of the flag indicating acceptance, $| \mathrm{rej}\rangle =| \mathrm{acc}\oplus 1\rangle$, $0\leqslant l\leqslant 1$, $0\leqslant b\leqslant \varepsilon$ and $\varepsilon \in [0,1]$.
• (2)  
  After d protocol runs with the same target circuit and v potentially different trap circuits, if all these runs are affected by independent and identically distributed (i.i.d.) noise, then the variation distance between noisy and noiseless probability distribution of the outputs of each of the ${N}_{\mathrm{acc}}\in [0,d]$ protocol runs ending with flag bit in the state $| \mathrm{acc}\rangle$ is upper-bounded as in equation (1).

Property 1 ensures that the probability of accepting the outputs of a single protocol run when the target circuit is affected by noise (the number b in equation (3)) is smaller than a constant ε. The constant ε is a function of the number of trap circuits, of the protocol and of the noise model and is to be computed analytically. The quantity $1-\varepsilon$ quantifies the credibility of the accreditation protocol.

Note that Property 1 in the above definition implies Property 2. To see this, assume Property 1 is valid for a given protocol. Suppose that this protocol is run d times with i.i.d. noise (a standard assumption in trap-based cryptographic protocols [29, 36]) and suppose that ${N}_{\mathrm{acc}}\gt 0$ protocol runs end with flag bit in the state $| \mathrm{acc}\rangle$. For each of these ${N}_{\mathrm{acc}}$ runs, the state of the system at the end of the protocol run is thus of the form (see equation (3))

$$\begin{eqnarray}&&{\rho }_{\mathrm{out},\mathrm{acc}}=\frac{(1-b)l\ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}+b\ {\tau }_{\mathrm{out}}^{\mbox{'}\mathrm{tar}}}{(1-b)l+b}\otimes | \mathrm{acc} \rangle \langle \mathrm{acc}| .\end{eqnarray} \tag{ 4 }$$

This yields a bound on the variation distance of the type [50]

$$\begin{eqnarray}&&\begin{array}{l}\displaystyle \frac{1}{2}\displaystyle \sum _{\overline{s}}\left|{p}_{\mathrm{noiseless}}(\overline{s})-{p}_{\mathrm{noisy}}(\overline{s})\right|\\ \quad \leqslant \ D\left({\sigma }_{\mathrm{out}}^{\mathrm{tar}},\displaystyle \frac{(1-b)l\ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}+b\ {\tau }_{\mathrm{out}}^{{\prime} \mathrm{tar}}}{(1-b)l+b}\right)\\ \quad \leqslant \displaystyle \frac{b}{(1-b)l+b}\ \leqslant \ \displaystyle \frac{\varepsilon }{\mathrm{prob}(\mathrm{acc})},\end{array}\end{eqnarray} \tag{ 5 }$$

where in the last inequality we used that $b\leqslant \varepsilon$ (Property 1) and that the quantity prob(acc)$=(1-b)l\,+\,b$ is the probability of accepting (equation (3)). Hoeffding's Inequality ensures that $| \mathrm{prob}(\mathrm{acc})-{N}_{\mathrm{acc}}/d| \leqslant \theta$ with confidence 1 − 2exp $(-2d{\theta }^{2})$ and this yields Property 2.

Bounding the variation distance as in equation (1) requires knowledge of the two numbers ε and ${N}_{\mathrm{acc}}$, the former obtained theoretically from the protocol and the latter experimentally from the device being tested. ε is a property of the protocol, of its input and of the noise model and can be computed without running the protocol. However, different devices running the same target circuit will suffer different noise levels and this is captured by ${N}_{\mathrm{acc}}$, which depends on the experimental device being tested. It is important to note that the bound on the variation distance is valid only for the outputs of the ${N}_{\mathrm{acc}}$ protocol runs ending with flag bit in the state $| \mathrm{acc}\rangle$. If a protocol run ends with flag bit in the state $| \mathrm{rej}\rangle$, Property 1 implies no bound on the variation distance and all rejected outputs must be discarded.

We can now present our accreditation protocol (a formal description can be found in Box 1 in the Methods).

2.3. Our accreditation protocol

Our accreditation protocol takes as input a classical description of the target circuit and the number v of trap circuits. The target circuit (figure 2) must start with qubits in the state $\left|+\right\rangle$, contain only single-qubit gates and cZ gates and end with a round of measurements in the Pauli-X basis¹ . Moreover, it must be decomposed as a sequence of bands, each one containing one round of single-qubit gates and one round of cZ gates. We will indicate the number of qubits with n and the number of bands with m.

Zoom In Zoom Out Reset image size

In our accreditation protocol $v+1$ circuits are implemented, one (chosen at random) being the target and the remaining v being the traps. The trap circuits are obtained by replacing the single-qubit gates in the target circuit with other single-qubit gates, but input state, measurements and cZ gates are the same as in the target (figure 3(a); all single-qubit gates acting on the same qubit in the same band must be recompiled into one gate). These single-qubit gates are chosen as follows (Routine 2, Box 3 in the Methods):

Zoom In Zoom Out Reset image size

For each band $j\in \{1,\ldots ,m-1\}$ and for each qubit $i\in \{1,\ldots ,n\}$:

• If qubit i is connected to another qubit $i^{\prime}$ by a cZ gate, a gate is chosen at random from the set $\{{H}_{i}\otimes {S}_{i^{\prime} },{S}_{i}\otimes {H}_{i^{\prime} }\}$ and is implemented on qubits i and $i^{\prime}$ in band j. This gate is then undone in band $j+1$.
• Otherwise, if qubit i is not connected to any other qubit by a cZ gate, a gate is chosen at random from the set $\{{H}_{i},{S}_{i}\}$ and is implemented on qubit i in band j. This gate is then undone in band $j+1$.

Moreover, depending on the random bit $t\in \{0,1\}$, the traps may begin and end with a round of Hadamard gates. Since $(S\otimes H){cZ}({S}^{\dagger }\otimes H)={cX}$, the trap circuits are a sequence of (randomly oriented) cX gates acting on ${\left|+\right\rangle }^{\otimes n}$ (if t = 0) or ${\left|0\right\rangle }^{\otimes n}$ (if t = 1)—figure 3(b). In the absence of noise, they always output $\overline{s}=\overline{0}$.

Our protocol requires appending a Quantum One-Time Pad (QOTP) to all single-qubit gates in all circuits (target and traps). This is described in Routine 1 in the Methods and is done as follows:

• For all bands j = 1,...,m and qubits i = 1,...,n, a random Pauli gate is appended after each gate ${U}_{i,j}$ (figure 4(a)). This yields
  $$\begin{eqnarray}&&{U}_{i,j}^{{\prime} }={X}_{i}^{{\alpha }_{i,j}^{{\prime} }}{Z}_{i}^{{\alpha }_{i,j}}{U}_{i,j},\end{eqnarray} \tag{ 6 }$$
  where ${\alpha }_{i,j},{\alpha }_{i,j}^{{\prime} }\in \{0,1\}$ are random bits.
• For all bands j = 2,...,m and qubits i = 1,...,n, another Pauli gate is appended before each single-qubit gate. This Pauli gate is chosen so that it undoes the QOTP coming from the previous band (figure 4(b)). Choosing this Pauli gate requires using the identities
  $$\begin{eqnarray}&&({X}_{1}\otimes {I}_{2}){cZ}={cZ}({X}_{1}\otimes {Z}_{2}),\end{eqnarray} \tag{ 7 }$$
  $$\begin{eqnarray}&&({Z}_{1}\otimes {I}_{2}){cZ}={cZ}({Z}_{1}\otimes {I}_{2}).\end{eqnarray} \tag{ 8 }$$
  This yields
  $$\begin{eqnarray}&&{U}_{i,j}^{{\prime\prime} }={X}_{i}^{{\alpha }_{i,j}^{{\prime} }}{Z}_{i}^{{\alpha }_{i,j}}{U}_{i,j}{P}_{i}\left(\{{\alpha }_{i,j-1}\}{}_{i},\{{\alpha }_{i,j-1}^{{\prime} }\}{}_{i}\right),\end{eqnarray} \tag{ 9 }$$
  where ${P}_{i}\left(\{{\alpha }_{i,j-1}\}{}_{i},{\left\{{\alpha }_{i,j-1}^{{\prime} }\right\}}_{i}\right)$ is a Pauli gate that depends on the QOTP in the previous band.
• A random Pauli-X gate is appended before all the gates ${U}_{i,1}^{{\prime} }$ in the first band. This yields
  $$\begin{eqnarray}&&{U}_{i,1}^{{\prime\prime} }={U}_{i,1}^{{\prime} }{X}_{i}^{{\gamma }_{i}^{{\prime} }}\end{eqnarray} \tag{ 10 }$$
  with ${\gamma }_{i}\in \{0,1\}$ chosen at random.

Zoom In Zoom Out Reset image size

Overall, replacing each gate ${U}_{i,j}$ with ${U}_{i,j}^{{\prime\prime} }$ yields a new circuit that is equivalent to the the original one, apart from the un-recovered QOTP ${\otimes }_{i=1}^{n}{X}^{{\alpha }_{i,m}^{{\prime} }}{Z}^{{\alpha }_{i,m}}$ in the last band. Since all measurements are in the Pauli-X basis, the Pauli-X component of this un-recovered QOTP is irrelevant, while its Pauli-Z component bit-flips some of the outputs. These bit-flips can be undone by replacing each output s_i with ${s}_{i}\oplus {\alpha }_{i,m}$ (a procedure that we call 'classical post-processing of the outputs'). This allows to recover the correct outputs.

After all the circuits have been implemented and the outputs have been post-processed, the flag bit is initialized to $| \mathrm{acc}\rangle =| 0\rangle$, then it is checked whether all the traps gave the correct output $\overline{s}=\overline{0}$. If they do, the protocol returns the output of the target together with the bit $| \mathrm{acc}\rangle$, otherwise it returns the output of the target together with the bit $| \mathrm{rej}\rangle =| 1\rangle$. The output of the target is only accepted in the first case, while it is discarded in the second case.

In the absence of noise, our protocol always returns the correct output of the target circuit and always accepts it. Correctness of the target is ensured by the fact that the QOTP has no effect on the computation, as all the extra Pauli gates cancel out with each other or are countered by the classical post-processing of the outputs. Acceptance is ensured by the fact that in the absence of noise all the trap circuits always yield the correct outcome $\overline{s}=\overline{0}$.

We will now consider a noisy implementation of our protocol, explain the role played by the various tools (QOTP, trap circuits etc.) and show that with single-qubit gates suffering bounded noise, our protocol ensures that wrong outputs are rejected with high probability.

2.4. The credibility of our protocol

As per equation (2), we model noise as a set of CPTP maps acting on the whole system and on the environment (figure 5). For simplicity, let us begin with the assumption that all the rounds of single-qubit gates in our protocol are noiseless, i.e. that for all circuits $k=1,\ldots ,v+1$ and bands j = 1,...,m, a noisy implementation of the round of single-qubit gates is (see figure 5 for notation)

$$\begin{eqnarray}&&{\widetilde{{ \mathcal U }}}_{j}^{{\prime\prime} (k)}={{ \mathcal E }}_{j}^{(k)}\left({{ \mathcal U }}_{j}^{{\prime\prime} (k)}\otimes {{ \mathcal I }}_{E}\right)\ \mathrm{with}\ {{ \mathcal E }}_{j}^{(k)}={{ \mathcal I }}_{{SE}},\end{eqnarray} \tag{ 11 }$$

where ${{ \mathcal I }}_{{SE}}$ is the identity on system and environment. Under this assumption, a first simplification to the noise of type N1 comes from the QOTP, a tool used in many works in verification [25] and benchmarking protocols [20, 51] that also plays a crucial role in our protocol. If single-qubit gates are noiseless, the QOTP allows to randomize all noise processes, even those non-local in space and time, to classically correlated Pauli errors (see lemma 1 in appendix A). A similar result was previously proven in [51] for Markovian noise, and here we show that this result holds also if the noise creates correlations in time.

Zoom In Zoom Out Reset image size

Having reduced arbitrary non-local noise to Pauli errors via the QOTP, we show (see lemma 2 in appendix B) that our trap circuits detect all Pauli errors with non-zero probability. The reasoning is as follows: since the trap circuits contain only Clifford gates, the noise acting at any point of a trap circuit can be factored to the end of the circuit. The noisy trap circuit is thus rewritten as the original one (figure 3(a)) with a Pauli-Z error $P\in \{I,Z\}{}^{\otimes n}$ applied before the measurements. If $P\ne {I}^{\otimes n}$, the trap outputs a wrong output ($\overline{s}\ne \overline{0}$) and the noise is detected. However, if the errors in different parts of the circuit happen to cancel out, then $P={I}^{\otimes n}$, the trap outputs $\overline{s}=\overline{0}$ and the noise is not detected. The role of H and S-gates in our trap circuits is to ensure that this happens with suitably low probability for all types of noise that can possibly affect the trap. These gates map Pauli errors into other Pauli errors as

$$\begin{eqnarray}\,\begin{array}{cccccc} & & & H & & S\\ X & \to & & Z & & Y\\ Y & \to & & Y & & X\\ Z & \to & & X & & Z\end{array},\end{eqnarray} \tag{ 12 }$$

where we omit unimportant prefactors (global phases do not affect outputs). Therefore, the random implementation of H and S-gates prevents errors in state preparation and two-qubit gates from canceling trivially. Similarly, the rounds of Hadamard gates activated at random at the beginning and at the end of the trap circuits prevent measurement errors from canceling trivially with noise happening before. These arguments are used to prove the claim of lemma 2, that states that our trap circuits can detect all possible Pauli errors with probability larger than 1/4.

The above arguments and lemmas can be used to prove that our protocol can detect arbitrary noise in state preparation, measurement and two-qubit gates, provided that single-qubit gates are noiseless:

Theorem 1. Suppose that all single-qubit gates in our accreditation protocol are noiseless. For any number $v\geqslant 3$ of trap circuits, our accreditation protocol can accredit the outputs of a noisy quantum computer affected by noise of the form N1 with

$$\begin{eqnarray}&&\varepsilon =\displaystyle \frac{\kappa }{v+1},\end{eqnarray} \tag{ 13 }$$

where $\kappa =3{\left(3/4\right)}^{2}\approx 1.7.$

To prove $\varepsilon =\kappa /(v+1)$ we write the state of the system at the end of a noisy protocol run as in equation (3). We do this using lemmas 1 and 2. The proof of theorem 1 is in appendix C.

We now relax the assumption of noiseless single-qubit gates and generalize our results to noise of the form N2. We assume that all rounds of single-qubit gates suffer bounded noise, i.e. that for all circuits $k=1,\ldots ,v+1$ and bands j = 1,...,m, a noisy implementation of the round of single-qubit gates is (see Figure 5 for notation)

$$\begin{eqnarray}&&{\widetilde{{ \mathcal U }}}_{j}^{{\prime\prime} (k)}={{ \mathcal E }}_{j}^{(k)}\left({{ \mathcal U }}_{j}^{{\prime\prime} (k)}\otimes {{ \mathcal I }}_{E}\right)\ \end{eqnarray} \tag{ 14 }$$

with ${{ \mathcal E }}_{j}^{(k)}=(1-{r}_{j}^{(k)}){{ \mathcal I }}_{{SE}}+{r}_{j}^{(k)}{{ \mathcal E }}_{j}^{{\prime} \ (k)}$ for some arbitrary CPTP map ${{ \mathcal E }}_{j}^{{\prime} \ (k)}$ acting on both system and environment and for some number $0\leqslant {r}_{j}^{(k)}\lt 1$. We refer to the number ${r}_{j}^{(k)}$ as 'error rate' of ${{ \mathcal U }}_{j}^{{\prime\prime} (k)}$. Since each ${{ \mathcal U }}_{j}^{{\prime\prime} (k)}$ is chosen at random (depending on whether circuit k is the target or a trap and on the QOTP) and since noise in single-qubit gates is potentially gate-dependent (condition N2), let us indicate with ${r}_{\max ,j}^{(k)}$ the maximum error rate of single-qubit gates in band j of circuit k, the maximum being taken over all possible choices of ${{ \mathcal U }}_{j}^{{\prime\prime} (k)}$.

We can now state theorem 2:

Theorem 2. Our protocol with $v\geqslant 3$ of trap circuits can accredit the outputs of a noisy quantum computer affected by noise of the form ${\rm{N}}1$ and ${\rm{N}}2$ with

$$\begin{eqnarray}&&\varepsilon =g\displaystyle \frac{\kappa }{v+1}+\ 1\ -g{\rm{}}\,,\end{eqnarray} \tag{ 15 }$$

where $\kappa =3{\left(3/4\right)}^{2}\approx 1.7$ and $g={\prod }_{j,k}(1-{r}_{\max ,j}^{(k)})$.

To calculate ε for the protocol with noisy single-qubit gates we use that ${{ \mathcal E }}_{j}^{(k)}=(1-{r}_{\max ,j}^{(k)}){{ \mathcal I }}_{{SE}}+{r}_{\max ,j}^{(k)}{{ \mathcal Q }}_{j}^{(k)}$, where ${{ \mathcal Q }}_{j}^{(k)}$ is a CPTP map encompassing the system and the environment. We can then rewrite the state of the system at the end of the protocol as

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}^{\star }=g{\rho }_{\mathrm{out}}+\left(1-g\right)\ {\tilde{\rho }}_{\mathrm{out}},\end{eqnarray} \tag{ 16 }$$

where ${\rho }_{\mathrm{out}}$ is the state of the system at the end of a protocol run with noiseless single-qubit gates—which by theorem 1 is of the form of equation (3) with $b\leqslant \kappa /(v+1)$—and ${\widetilde{\rho }}_{\mathrm{out}}$ is a quantum state containing the effects of noise in single-qubit gates. Expressing ${\widetilde{\rho }}_{\mathrm{out}}$ as

$$\begin{eqnarray}&&{\widetilde{\rho }}_{\mathrm{out}}=h\ {\widetilde{\tau }}_{1}^{\mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| +(1-h)\ {\widetilde{\tau }}_{2}^{\mathrm{tar}}\otimes | \mathrm{rej}\rangle \langle \mathrm{rej}| ,\end{eqnarray} \tag{ 17 }$$

where ${\widetilde{\tau }}_{1}^{\mathrm{tar}}$ and ${\widetilde{\tau }}_{2}^{\mathrm{tar}}$ are arbitrary states for the target and $0\leqslant h\leqslant 1$, we thus have

$$\begin{eqnarray}\begin{array}{rcl}{\rho }_{\mathrm{out}}^{\star } & = & g\left[b\ {\tau }_{\mathrm{out}}^{\mbox{'}\mathrm{tar}}\otimes | \mathrm{acc} \rangle \langle \mathrm{acc}| +(1-b)\left(l\ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{acc} \rangle \langle \mathrm{acc}| \right.\right.\\ & & \left.\left.+(1-l){\tau }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{rej} \rangle \langle \mathrm{rej}| \right)\right]+(1-g)\left[h\ {\tilde{\tau }}_{1}^{\mathrm{tar}}\otimes | \mathrm{acc} \rangle \langle \mathrm{acc}| \right.\\ & & \left.+(1-h)\ {\tilde{\tau }}_{2}^{\mathrm{tar}}\otimes | \mathrm{rej} \rangle \langle \mathrm{rej}| \right].\end{array}\end{eqnarray} \tag{ 18 }$$

As it can be seen, the probability that the target is in the wrong state and the flag bit is in the state $| \mathrm{acc}\rangle$ is ${gb}+(1-g)h\leqslant g\kappa /(v+1)+(1-g)h$, where we used that $b\leqslant \kappa /(v+1)$ from theorem 1. This probability reaches its maximum for h = 1, therefore we have $\varepsilon =g\kappa /(v+1)+1-g$. Note that if ${r}_{\max ,j}^{(k)}\leqslant {r}_{0}\ll 1$, then

$$\begin{eqnarray}&&g\geqslant \displaystyle \prod _{k=1}^{v+1}\displaystyle \prod _{j=1}^{m}(1-{r}_{0})\approx 1-m(v+1){r}_{0}+O({r}_{0}^{2}).\end{eqnarray} \tag{ 19 }$$

Thus, if ${r}_{0}\ll 1/m(v+1)$, then $g\approx 1$ and ε ≈ 1.7/(v + 1).

It is worth noting that our theorem 1 also holds if single-qubit gates suffer unbounded noise, provided that this noise is gate-independent. Indeed, if ${{ \mathcal E }}_{j}^{(k)}={ \mathcal E }$ does not depend on the parameters in ${{ \mathcal U }}_{j}^{{\prime\prime} (k)}$ (see figure 5 for notation), using ${{ \mathcal E }}_{j}^{(k)}{ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal F }}_{j}^{(k)}={ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal F }}_{j}^{{\prime} (k)}$ (with ${{ \mathcal F }}_{j}^{{\prime} (k)}={ \mathcal C }{{ \mathcal Z }}_{j}^{-1}{{ \mathcal E }}_{j}^{(k)}{ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal F }}_{j}^{(k)}$) we can factor this noise into that of ${ \mathcal C }{{ \mathcal Z }}_{j}$ and prove $\varepsilon =\kappa /(v+1)$ with the same arguments used in theorem 1. Similarly, we also expect our theorem 2 to hold if noise in single-qubit gates has a weak gate-dependence, as is the case for some of the protocols centered around randomized benchmarking [19]. We leave the analysis of weakly gate-dependent noise to future works.

2.5. Mesothetic verification protocol

In Box 4 in the Methods we translate our accreditation protocol into a cryptographic protocol, obtaining what we call 'mesothetic' verification protocol. To verify an n-qubit computation, in the mesothetic protocol the verifier (Alice) must possess a device that can receive n qubits from the prover (Bob), implement single-qubit gates on all of them and send the qubits back to the Bob. In appendix D we present theorems D1 and D2, which are the counterparts of theorems 1 and 2 for the cryptographic protocol. In the first two theorems the number ε is replaced by the soundness ${\varepsilon }_{\mathrm{cr}}$ (see definition 4 in appendix D.2), namely the probability that Alice accepts a wrong output for the target when Bob is cheating.

Our mesothetic verification protocol is different from prepare-and-send [26–33] or receive-and-measure [34–38] cryptographic protocols in that Alice encrypts the computation through the QOTP during the actual implementation of the circuits, and not before or after the implementation. To do this, she must possess an n-qubit quantum memory and be able to execute single-qubit gates. Despite being scalable, our protocol is more demanding that those in [27–38], where Alice only requires a single-qubit memory. This suggests the interesting possibility that protocols optimized for experiments may translate into more demanding cryptographic protocols and vice-versa.

Similarly to post-hoc verification protocols [35, 43], our protocol is not blind. Alice leaks crucial information to Bob regarding the target circuit, such as the position of two-qubit gates. This is not a concern for our goals, as verifiability in our protocol relies on Bob being incapable to distinguish between target and trap circuits, i.e. to retrieve the number v₀, see lemma D3 in appendix D.2.

Blindness may be required to protect user's privacy in future scenarios of delegated quantum computing [53]. In appendix D.2 we thus show how to make our protocol blind. This requires recompiling the target circuit into a circuit in normal form with fixed cZ gates, such as the brickwork-type circuit in figure 6. This yields an increase in circuit depth, hence the minimal overheads of our protocol must be traded for blindness.

Zoom In Zoom Out Reset image size

We have presented a trap-based accreditation protocol for the outputs of NISQ devices. Our protocol is scalable and practical, and relies on minimal assumptions on the noise. Specifically, our protocol requires that single-qubit gates suffer bounded (but potentially gate-dependent and non-local in space and time) noise.

A single protocol run ends by either accepting or rejecting the output of the target circuit that we seek to accredit. We can then run our accreditation protocol multiple times (with the same target and with the same number of traps), each time keeping the output if the protocol accepts and discarding it if the protocol rejects. After multiple runs with i.i.d. noise, our protocol allows to bound the variation distance between noisy and noiseless probability distribution of the accepted outputs (equation (1)).

Real-world devices can be accredited by running our protocol on them. The accreditation is provided by bounds on the variation distance that rely on ε, which we obtained in theorems 1 and 2, and the acceptance probability prob(acc) of our accreditation protocol. The latter is estimated experimentally by running our protocol multiple times on the device being accredited.

Some noise models allow to lower-bound the acceptance probability analytically and consequently to upper-bound the variation distance. For instance, if all operations ${{ \mathcal E }}_{S}^{(p)}$ in our protocol suffer bounded noise and have error rates r_p, we can write the state of the system at the end of the protocol as

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}=\delta \ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| +(1-\delta )\widetilde{\tau },\end{eqnarray} \tag{ 21 }$$

where ${\sigma }_{\mathrm{out}}^{\mathrm{tar}}$ is the state of the target at the end of a noiseless protocol run, $\widetilde{\tau }$ is an arbitrary state for target and flag and $\delta ={\prod }_{p}(1-{r}_{p})\in [0,1]$. This yields prob(acc) $\,\geqslant \,\delta$ and (see equation (5))

$$\begin{eqnarray}&&\displaystyle \frac{1}{2}\displaystyle \sum _{\overline{s}}\left|{p}_{\mathrm{noiseless}}(\overline{s})-{p}_{\mathrm{noisy}}(\overline{s})\right|\leqslant \displaystyle \frac{\varepsilon }{\mathrm{prob}(\mathrm{acc})}\leqslant \displaystyle \frac{\varepsilon }{\delta }.\end{eqnarray} \tag{ 22 }$$

In figure 7 we plot the RHS of the above equation. Plots of this type can be used to seek error rates that will provide the desired upper-bound on the variation distance.

Zoom In Zoom Out Reset image size

Considering the error rates of present NISQ devices [2, 45–48] we expect that our protocol may provide worthwhile upper-bounds for target circuits with up to $n\approx 7$ qubits and $m\approx 7$ bands (figure 7(a)). We also expect that larger target circuits may yield upper-bounds that are too large to be useful. In fact, for large target circuits, it is also possible that none of the protocol runs will accept the output of the target, and thus that our protocol will provide no upper-bound. Nevertheless, it is worth remarking that this does not indicate that our accreditation protocol is unable to accredit computations on NISQ devices. On the contrary, by providing large upper-bounds, our protocol reveals that the device being tested suffers high levels of noise and that its outputs are not credible.

Our work leaves several open questions. Our theorem 2 shows that our protocol requires reducing the error rates of single-qubit gates with the size of the target circuit. This requirement is similar to that found in other works [29, 38, 41], and is a known obstacle towards scalable quantum computing. A strategy that has been exploited in previous works is to incorporate fault-tolerance into the existing protocols [29, 41]. Another has been to define verifiable fault-tolerance using notions such as acceptability and detectability [54]. Interfacing fault tolerance with accreditation is an interesting challenge for the future.

Another open question regards the applicability of our accreditation protocol if single-qubit gates suffer unbounded noise. In its current state, the analysis of our protocol does not account for unbounded gate-dependent noise in single-qubit gates, including unitary errors such as over- or under-rotations. The reason is that the QOTP (which maps coherent errors into classically correlated Pauli errors) is applied at the level of single-qubit gates. Unbounded errors that depend on the gates used to randomize arbitrary noise processes to Pauli errors are an obstacle to other works including cryptographic protocols [29] and protocols based on randomized benchmarking [16–18, 20, 21].

Finally, with the mesothetic protocol we show how to adapt our protocol to the cryptographic setting. In the mesothetic protocol the verifier requires an n-qubit memory and the ability to execute single-qubit gates. This protocol ismore demanding than several existing cryptographic protocols [27–38] requiring single-qubit memory for the verifier. An interesting question is whether a mesothetic protocol can be devised that only requires single-qubit gates and single-qubit memory for the verifier.

4.1. Overhead of our accreditation protocol

Here we count the overhead of our protocol. Our protocol has no quantum overhead, as all circuits have the same size as the one being verified. The classical overhead consists in O(nm) bits for each of the $v+1$ computations. Specifically, the target computation has an overhead of $2{nm}+n$ bits (the $2{nm}$ random bits ${\alpha }_{i,j},{\alpha }_{i,j}^{{\prime} }$ and the n random bits ${\gamma }_{i}$ in Routine 1), while the traps have an overhead of at most $2{nm}+n+{nm}$ bits (the $2{nm}+n$ random bits in Routine 1 and at most nm random bits in Routine 2).

Box 1. Accreditation protocol.

Input:

1. A target circuit that takes as input n qubits in the state $\left|+\right\rangle$, contains only single-qubit gates and cZ gates arranged in m bands and ends with Pauli-X measurements (figure 2).

2. The number v of trap circuits.

Routine:

1. Choose a random number ${v}_{0}\in \{1,\ldots ,v+1\}$ and define $\{{U}_{i,j}^{({v}_{0})}\}=\{{U}_{i,j}\}$, where $\{{U}_{i,j}\}$ is the set of single-qubit gates in the target circuit.

2. For $k=1,\ldots ,v+1$: If $k\ne {v}_{0}$ (trap circuit), run Routine 2 and obtain the set of single-qubit gates $\{{U}_{i,j}^{(k)}\}$ for the kth trap circuit.

3. For $k=1,\ldots ,v+1$: run Routine 1 and obtain $\{{U}_{i,j}^{{\prime\prime} (k)}\}$, together with the bit-string $({\alpha }_{1,m}^{(k)},\ldots {\alpha }_{n,m}^{(k)})$.

4. For $k=1,\ldots ,v+1$:

4.1 Create a state ${\rho }_{\mathrm{in}}=| +{\rangle }^{\otimes n}$.

4.2 Implement circuit k with single-qubit gates from the set $\{{U}_{i,j}^{{\prime\prime} (k)}\}$ and obtain output ${\overline{s}}^{(k)}=({s}_{1}^{(k)},\ldots ,{s}_{n}^{(k)})$. Next, for all i = 1,...,n, recompute ${s}_{i}^{(k)}$ as ${s}_{i}^{(k)}\oplus {\alpha }_{i,m}^{(k)}$.

5. Initialize a flag bit to $| \mathrm{acc}\rangle =| 0\rangle$. Then, for $k=1,\ldots ,v+1$: if ${\overline{s}}^{(k)}\ne \overline{0}$ and $k\ne {v}_{0}$ (trap circuit), set the flag bit to $| \mathrm{rej}\rangle =| \mathrm{acc}\oplus 1\rangle$.

Output:

The output ${\overline{s}}^{({v}_{0})}$ of the target circuit and the flag bit.

Box 2. Routine 1. (Quantum one-time pad).

Input:

A set $\{{U}_{i,j}\}$ of single-qubit gates, for j = 1,...,m and i = 1,...,n.

Routine:

1. For j = 1,...,m and i = 1,...,n:

Choose two random bits ${\alpha }_{i,j}$ and ${\alpha }_{i,j}^{{\prime} }$. Next, define ${U}_{i,j}^{{\prime} }={X}^{{\alpha }_{i,j}^{{\prime} }}{Z}^{{\alpha }_{i,j}}{U}_{i,j}$.

2. For i = 1,...,n:

Choose a random bit ${\gamma }_{i}$ and define ${U}_{i,1}^{{\prime\prime} }={U}_{i,1}^{{\prime} }{X}^{{\gamma }_{i}}$.

3. For $j=1,\ldots ,m-1$:

Using equations (7) and (8) define ${U}_{i,j+1}^{{\prime\prime} }$ so that $$\begin{eqnarray}&&\,\left({\otimes }_{i}\,{U}_{i,j+1}^{{\prime\prime} }\right){\widehat{{cZ}}}_{j}\left({\otimes }_{i}\,{U}_{i,j}^{{\prime} }\right)=\left({\otimes }_{i}\,{U}_{i,j+1}^{{\prime} }\right){\widehat{{cZ}}}_{j}\left({\otimes }_{i}\,{U}_{i,j}\right),\end{eqnarray} \tag{ 20 }$$ where ${\widehat{{cZ}}}_{j}$ is the entangling operation in the jth band.

Output:

The set $\{{U}_{i,j}^{{\prime\prime} }\}$ and the n-bit string $({\alpha }_{1,m},\ldots ,{\alpha }_{n,m})$.

Box 3. Routine 2. (Single-qubit gates for trap circuits).

Input:

The target circuit.

Routine:

1. Initialize the set $\{{U}_{i,j}={I}_{i}\}$, for i = 1,...,n and j = 1,...,m.

2. For all $j=1,\ldots ,m-1$:

2.1 For all i = 1,...,n: If in band j of the target circuit qubits i and $i^{\prime}$ are connected by a cZ gate, set

•${U}_{i,j}={S}_{i}{U}_{i,j}$ and ${U}_{i^{\prime} ,j}={H}_{i^{\prime} }{U}_{i^{\prime} ,j}$ with probability 1/2.

•${U}_{i,j}={H}_{i}{U}_{i,j}$ and ${U}_{i^{\prime} ,j}={S}_{i^{\prime} }{U}_{i^{\prime} ,j}$ with probability 1/2.

Otherwise, set ${U}_{i,j}={S}_{i}{U}_{i,j}$ or ${U}_{i,j}={H}_{i}{U}_{i,j}$ with probability 1/2.

2.2 For all i = 1,...,n: Set ${U}_{i,j+1}={U}_{i,j}^{\dagger }$.

3. For all i = 1,...,n:

Choose a random bit $t\in \{0,1\}$. Next, set ${U}_{i,1}={U}_{i,1}{H}^{t}$ and ${U}_{i,m}={H}^{t}{U}_{i,m}$.

Output:

The set $\{{U}_{i,j}\}$.

Box 4. Mesothetic protocol (further details in appendix D.)

Input:

A classical description of the target circuit and the number v of traps. (The input is known to both Alice and Bob).

Preliminary Operations:

1. Alice randomly chooses which circuit ${v}_{0}\in \{1,\ldots ,v+1\}$ will be used to implement the target. Next she defines $\{{U}_{i,j}^{({v}_{0})}\}=\{{U}_{i,j}\}$, where $\{{U}_{i,j}\}$ is the set of single-qubit gates in the target circuit.

2. For $k=1,\ldots ,v+1$: If $k\ne {v}_{0}$ (trap circuit), Alice runs Routine 2 and obtains the set $\{{U}_{i,j}^{(k)}\}$ of single-qubit gates for the kth circuit.

3. For $k=1,\ldots ,v+1$: Alice runs Routine 1 and obtains the set of gates $\{{U}_{i,j}^{{\prime\prime} (k)}\}$, together with the random bits ${\alpha }_{i,m}^{(k)}$.

Routine:

4. For all $k=1,\ldots ,v+1$, Alice and Bob interact as follows:

4.1 Bob creates n qubits in state $\left|+\right\rangle$.

4.2 For j = 1,...,m:

4.2.1 Bob sends all the qubits to Alice. For i = 1,...,n, Alice executes ${U}_{i,j}^{{\prime\prime} (k)}$ on qubit i. Finally, Alice sends all the qubits back to Bob.

4.2.2 Bob applies the entangling gates ${\widehat{{cZ}}}_{j}$ contained in the jth band of the target circuit.

4.3 For i = 1,...,n: Bob measures qubit i in the Pauli-X basis and communicates the output to Alice. Alice bit-flips the output if ${\alpha }_{i,m}^{(k)}=1$, otherwise she does nothing. Next, if $k\ne {v}_{0}$ and this output is si = 1, Alice aborts the protocol, otherwise she does nothing.

5. Alice initializes a flag bit to the state $| \mathrm{acc}\rangle =| 0\rangle$. Next, for all $k=1,\ldots ,v+1$: if $k\ne {v}_{0}$ (trap circuit) and ${s}_{i}^{(k)}\oplus {\alpha }_{i,m}^{(k)}\ne 0$ for some $i\in \{1,\ldots ,n\}$, Alice sets the flag bit to $| \mathrm{rej}\rangle =| \mathrm{acc}\oplus 1\rangle$.

Output:

The outputs of the target circuit and the flag bit.

This research was supported by the UK EPSRC (EP/K04057X/2) and the UK Networked Quantum In- formation Technologies (NQIT) Hub (EP/M013243/1). We acknowledge helpful discussions with Joel Wallman, Elham Kashefi, Dominic Branford, Zhang Jiang, Joseph Emerson.

In these appendices we will indicate the action of the round of single-qubit gates in a band $j\in \{1,\ldots ,m\}$ of a circuit $k\in \{1,\ldots ,v+1\}$ as ${{ \mathcal U }}_{j}^{{\prime\prime} (k)}({\rho }_{S})={\otimes }_{i=1}^{n}{U}_{i,j}^{{\prime\prime} (k)}({\rho }_{S}){U}_{i,j}^{\dagger ^{\prime\prime} (k)}$, where ${\rho }_{S}$ is the state of the system. Similarly, we will indicate the action of a round of cZ gates on the system as ${ \mathcal C }{{ \mathcal Z }}_{j}({\rho }_{S})={\widehat{{cZ}}}_{j}({\rho }_{S}){\widehat{{cZ}}}_{j}$, where ${\widehat{{cZ}}}_{j}$ is the tensor product of all cZ gates in band j in the target circuit, and the action of n-qubit Pauli operators as ${ \mathcal P }\in \{{ \mathcal I },{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}{}^{\otimes n}$, where ${ \mathcal I }(\rho )=\rho$, ${ \mathcal X }(\rho )=X\rho X$, ${ \mathcal Y }(\rho )=Y\rho Y$, ${ \mathcal Z }(\rho )=Z\rho Z$ are single-qubit Pauli operators.

In appendix A we provide statement and proof of lemma 1, In appendix B we provide statement and proof of lemma 2 , In appendix C we prove theorem 1 and in appendix D we prove soundness of the mesothetic protocol.

We now present and prove lemma 1, which is as follows:

Lemma 1. Suppose that all single-qubit gates in all the circuits implemented in our protocol are noiseless, and that state preparation, measurements and two-qubit gates suffer noise of the type type N1. For a fixed choice of single-qubit gates ${{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}$, summed over all the random bits ${\alpha }_{i,j},{\alpha }_{i,j}^{{\prime} },{\gamma }_{i}$ (see Routine 1), the joint state of the target circuit and of the traps after they have all been implemented is of the form

$$\begin{eqnarray}\begin{array}{rcl}{\rho }_{\mathrm{out}}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right) & = & \displaystyle \sum _{{\overline{s}}^{(1)},\ldots ,{\overline{s}}^{(v+1)}}\ \displaystyle \sum _{{{ \mathcal P }}_{0}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}}\displaystyle \frac{\mathrm{prob}\left({{ \mathcal P }}_{0}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)}{{2}^{n(v+1)}}\ \\ & & \times \underset{k=1}{\overset{v+1}{\displaystyle \bigotimes }}\ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{{\overline{s}}^{(k)}}{{ \mathcal P }}_{m}^{(k)}{{ \mathcal U }}_{m}^{(k)}{\circ }_{j=1}^{m-1}\left({ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}^{(k)}{{ \mathcal U }}_{j}^{(k)}\right)\,\circ \,{{ \mathcal P }}_{0}^{(k)}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\left({\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}^{(k)}}\right),\end{array}\end{eqnarray} \tag{ A1 }$$

where ${\rho }_{\mathrm{in}}={\otimes }_{i}| +{\rangle }_{i}\langle +|$, ${\overline{s}}^{(k)}=({s}_{1}^{(k)},\ldots ,{s}_{n}^{(k)})$ is a binary string representing the output of the kth circuit, ${{ \mathcal Z }}^{{\overline{s}}^{(k)}}(\rho )={\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}\rho {Z}_{i}^{{s}_{i}^{(k)}}$ and $\mathrm{prob}\left({{ \mathcal P }}_{0}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)$ is the joint probability of a collection of Pauli errors ${{ \mathcal P }}_{0}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}$ affecting the system, with ${{ \mathcal P }}_{1}^{(k)},\ldots ,{{ \mathcal P }}_{m-1}^{(k)}\in \{{ \mathcal I },{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}{}^{\otimes n}$ and ${{ \mathcal P }}_{0}^{(k)},{{ \mathcal P }}_{m}^{(k)}\in \{I,{ \mathcal Z }\}{}^{\otimes n}$ for all k.

This lemma shows that if single-qubit gates are noiseless, the QOTP allows to reduce noise of the type N1 to classically correlated Pauli errors. These Pauli errors affect each circuit after state preparation (${{ \mathcal P }}_{0}^{(k)}$), before each entangling operation ${ \mathcal C }{{ \mathcal Z }}_{j}$ (${{ \mathcal P }}_{j}^{(k)}$, for $j\in \{1,\ldots ,m-1\}$) and before the measurements (${{ \mathcal P }}_{m}^{(k)}$). Errors in the cZ gates can be Pauli-X, Y and Z, while those in state preparation and measurements are Pauli-Z (this is because their Pauli-X components stabilize ${\rho }_{\mathrm{in}}$ and Pauli-X measurements respectively).

The main tool used in this section is the 'Pauli Twirl' [18].

(Pauli Twirl). Let ρ be a ${2}^{n}\times {2}^{n}$ density matrix and let $P,P^{\prime}$ be two n-fold tensor products of the set of Pauli operators $\{I,X,Y,Z\}$. Denoting by $\{{Q}_{r}\}$ the set of all n-fold tensor products of the set of Pauli operators $\{I,X,Y,Z\}$,

$$\begin{eqnarray}&&\displaystyle \sum _{r=1}^{{4}^{n}}{Q}_{r}{{PQ}}_{r}\rho {Q}_{r}P^{\prime} {Q}_{r}=0{\rm{}}\,{\rm{\forall }}P\ne P^{\prime} .\end{eqnarray} \tag{ A2 }$$

We will also use a restricted version of the Pauli Twirl, which is proven in [29]

(Restricted Pauli Twirl). Let ρ be a ${2}^{n}\times {2}^{n}$ density matrix and let $P,P^{\prime}$ be two n-fold tensor products of the set of Pauli operators $\{I,Z\}$. Denoting by $\{{Q}_{r}\}$ the set of all n-fold tensor products of the set of Pauli operators $\{I,X\}$,

$$\begin{eqnarray}&&\displaystyle \sum _{r=1}^{{2}^{n}}{Q}_{r}{{PQ}}_{r}\rho {Q}_{r}P^{\prime} {Q}_{r}=0{\rm{}}\,{\rm{\forall }}P\ne P^{\prime} .\end{eqnarray} \tag{ A3 }$$

The same holds if P and $P^{\prime}$ are two n-fold tensor products of the set of Pauli operators $\{I,X\}$ and $\{{Q}_{r}\}$ is the set of all n-fold tensor products of the set of Pauli operators $\{I,Z\}$.

Proof. (Lemma 1) We start proving the lemma for the case where we run a single circuit (v = 0), and then we generalize to multiple circuits ($v\gt 0$). Including all purifications in the environment, we can rewrite the noise as unitary matrices acting on system and environment (for clarity we write these unitaries in bold font). Doing this, for a fixed choice of gates ${{ \mathcal U }}_{j}^{{\prime\prime} },\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} }$ (which depend on the choice of gates ${{ \mathcal U }}_{1}^{},\ldots ,{{ \mathcal U }}_{m}^{}$ and on all the random bits ${\alpha }_{i,j},{\alpha }_{i,j}^{{\prime} },{\gamma }_{i}$, see Routine 1), the state of the system before the measurement becomes (figure 8)

$$\begin{eqnarray}&&\begin{array}{l}\rho \left({{ \mathcal U }}_{1}^{{\prime\prime} },\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} }\right)\\ \quad =\,{\mathrm{Tr}}_{{\rm{E}}}\left[{\bf{M}}\ {U}_{m}^{{\prime\prime} }{\widehat{{cZ}}}_{m-1}{{\bf{F}}}_{m-1}{U}_{m-1}^{{\prime\prime} }\ldots {\widehat{{cZ}}}_{1}{{\bf{F}}}_{1}{U}_{1}^{{\prime\prime} }{\bf{R}}\left({\rho }_{{\rm{in}}}\otimes {\rho }_{E}\right){{\bf{R}}}^{\dagger }\ {U}_{1}^{{\prime\prime} \dagger }{{\bf{F}}}_{1}^{\dagger }{\widehat{{cZ}}}_{1}\ldots {U}_{m-1}^{{\prime\prime} \dagger }{{\bf{F}}}_{m-1}^{\dagger }{\widehat{{cZ}}}_{m-1}{U}_{m}^{{\prime\prime} \dagger }{{\bf{M}}}^{\dagger }\right],\end{array}\end{eqnarray} \tag{ A4 }$$

where ${\rho }_{{\rm{in}}}={\otimes }_{i}\,| +{\rangle }_{i}\langle +|$, ${\rho }_{E}=| {e}_{0}\rangle \langle {e}_{0}|$ is the initial state of the environment, ${U}_{j}^{{\prime\prime} }={\otimes }_{i}\,{U}_{i,j}^{{\prime\prime} }$ are the gates output by Routine 1, the unitary matrix ${\bf{R}}$ represents the noise in state preparation, the unitary matrix ${\bf{M}}$ represents the noise in the measurements, ${\widehat{{cZ}}}_{j}{{\bf{F}}}_{j}$ is the noisy round of entangling gates in a band j and Tr${}_{{\rm{E}}}\left[\cdot \right]$ is the trace over the environment.

For simplicity, we first prove our result for a circuit with m = 2 bands and generalize to $m\gt 2$ bands later. In this case, defining an orthonormal basis $\{| {e}_{p}\rangle \langle {e}_{p}| \}$ for the environment, the state in equation (A4) is

$$\begin{eqnarray}&&\rho \left({{ \mathcal U }}_{1}^{{\prime\prime} },{{ \mathcal U }}_{2}^{{\prime\prime} }\right)=\displaystyle \sum _{p}\langle {e}_{p}| {\bf{M}}\ {U}_{2}^{{\prime\prime} }{\widehat{{cZ}}}_{1}{{\bf{F}}}_{1}{U}_{1}^{{\prime\prime} }{\bf{R}}\left({\rho }_{{\rm{in}}}\otimes | {e}_{0}\rangle \langle {e}_{0}| \right){{\bf{R}}}^{\dagger }\ {U}_{1}^{{\prime\prime} \dagger }{{\bf{F}}}_{1}^{\dagger }{\widehat{{cZ}}}_{1}{U}_{2}^{{\prime\prime} \dagger }{{\bf{M}}}^{\dagger }| {e}_{p}\rangle .\end{eqnarray} \tag{ A5 }$$

Introducing resolutions of the identity on the environment before and after every noise operator, we have

$$\begin{eqnarray}\begin{array}{rcl}\rho \left({{ \mathcal U }}_{1}^{{\prime\prime} },{{ \mathcal U }}_{2}^{{\prime\prime} }\right) & = & \displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{p}{{k}_{1},{k}_{2},{l}_{1},{l}_{2}}}\left[\langle {e}_{p}| {\bf{M}}| {e}_{{k}_{1}}\rangle \ {U}_{2}^{{\prime\prime} }{\widehat{{cZ}}}_{1}\langle {e}_{{k}_{1}}| {{\bf{F}}}_{1}| {e}_{{k}_{2}}\rangle {U}_{1}^{{\prime\prime} }\langle {e}_{{k}_{2}}| {\bf{R}}| {e}_{0}\rangle \right]\left({\rho }_{{\rm{in}}}\right)\\ & & \times \left[\langle {e}_{0}| {{\bf{R}}}^{\dagger }| {e}_{{l}_{2}}\rangle \ {U}_{1}^{{\prime\prime} \dagger }\langle {e}_{{l}_{2}}| {{\bf{F}}}_{1}^{\dagger }| {e}_{{l}_{1}}\rangle {\widehat{{cZ}}}_{j}{U}_{2}^{{\prime\prime} \dagger }\langle {e}_{{l}_{1}}| {{\bf{M}}}^{\dagger }| {e}_{p}\rangle \right],\end{array}\end{eqnarray} \tag{ A6 }$$

since ${\sum }_{k}| {e}_{k}\rangle \langle {e}_{k}| ={I}_{E}$ and $\langle {e}_{k}| {V}_{S}| {e}_{k^{\prime} }\rangle ={V}_{S}{\delta }_{k,k^{\prime} }$ for every operator V_S acting only on the system. The operators $\langle {e}_{p}| {\bf{M}}| {e}_{{k}_{1}}\rangle ,\langle {e}_{{k}_{1}}| {{\bf{F}}}_{1}| {e}_{{k}_{2}}\rangle ,\langle {e}_{{k}_{2}}| {\bf{R}}| {e}_{0}\rangle ,\langle {e}_{0}| {{\bf{R}}}^{\dagger }| {e}_{{l}_{2}}\rangle ,\langle {e}_{{l}_{2}}| {{\bf{F}}}_{1}^{\dagger }| {e}_{{l}_{1}}\rangle ,\langle {e}_{{l}_{1}}| {{\bf{M}}}^{\dagger }| {e}_{p}\rangle$ act only on the system, and can thus be written as in table 1.

In table 1, ${P}_{\mu }\in \{I,X,Y,Z\}{}^{\otimes n}$ are n-fold tensor products of Pauli operators acting on the system and ${\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}.{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}.{\eta }_{{k}_{p},{k}_{1},{\mu }_{3}}^{(M)}$ are complex numbers. We then obtain

$$\begin{eqnarray}&&\rho \left({{ \mathcal U }}_{1}^{{\prime\prime} },{{ \mathcal U }}_{2}^{{\prime\prime} }\right)=\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3}}}{{\nu }_{1},{\nu }_{2},{\nu }_{3}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\nu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\nu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\nu }_{3}}^{* (M)}\right)\ {P}_{{\mu }_{3}}{U}_{2}^{{\prime\prime} }{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{{\prime\prime} }{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\nu }_{1}}{U}_{1}^{{\prime\prime} \dagger }{P}_{{\nu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{{\prime\prime} \dagger }{P}_{{\nu }_{3}}.\end{eqnarray} \tag{ A7 }$$

We will now describe how to apply the Pauli twirl lemmas iteratively, in the order the operations apply on the input. Therefore, we start by showing how to eliminate terms of the sum where ${\mu }_{1}\ne {\nu }_{1}$. Since X stabilizes $\left|+\right\rangle$ states, we can rewrite ${\rho }_{{\rm{in}}}$ as $\left({\otimes }_{i}\,{X}_{i}^{{\gamma }_{i}}\right){\rho }_{{\rm{in}}}\left({\otimes }_{i}\,{X}_{i}^{{\gamma }_{i}}\right)$. Moreover, using ${U}_{1}^{{\prime\prime} }={U}_{1}^{{\prime} }\left({\otimes }_{i}\,{X}_{i}^{{\gamma }_{i}}\right)$, see Routine 1, the above state becomes

$$\begin{eqnarray}&&\begin{array}{l}\rho \left({{ \mathcal U }}_{1}^{{\prime\prime} },{{ \mathcal U }}_{2}^{{\prime\prime} }\right)=\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3}}}{{\nu }_{1},{\nu }_{2},{\nu }_{3}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\nu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\nu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\nu }_{3}}^{* (M)}\right)\\ \quad {P}_{{\mu }_{3}}{U}_{2}^{{\prime\prime} }{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{{\prime} }\left({\otimes }_{i}\,{X}_{i}^{{\gamma }_{i}}\right){P}_{{\mu }_{1}}\left({\otimes }_{i}\,{X}_{i}^{{\gamma }_{i}}\right)\left({\rho }_{{\rm{in}}}\right)\left({\otimes }_{i}\,{X}_{i}^{{\gamma }_{i}}\right){P}_{{\nu }_{1}}\left({\otimes }_{i}\,{X}_{i}^{{\gamma }_{i}}\right){U}_{1}^{{\prime} \dagger }{P}_{{\nu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{{\prime\prime} \dagger }{P}_{{\nu }_{3}}.\end{array}\end{eqnarray} \tag{ A8 }$$

Summing over all possible ${\gamma }_{i}$ and applying the Restricted Pauli Twirl (the Pauli-X components of both ${P}_{{\mu }_{1}}$ and ${P}_{{\nu }_{1}}$ stabilize ${\rho }_{\mathrm{in}}$ and can thus be ignored), we obtain a factor ${\delta }_{{\mu }_{1},{\nu }_{1}}$, and thus the above state becomes

$$\begin{eqnarray}\begin{array}{rcl}\rho \left({{ \mathcal U }}_{1}^{{\prime} },{{ \mathcal U }}_{2}^{{\prime\prime} }\right) & = & \displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\{{\gamma }_{i}\}}\rho \left({{ \mathcal U }}_{1}^{{\prime\prime} },{{ \mathcal U }}_{2}^{{\prime\prime} }\right)\\ & = & \displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3}}}{{\nu }_{2},{\nu }_{3}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\nu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\nu }_{3}}^{* (M)}\right){P}_{{\mu }_{3}}{U}_{2}^{{\prime\prime} }{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{{\prime} }{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{{\prime} \dagger }{P}_{{\nu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{{\prime\prime} \dagger }{P}_{{\nu }_{3}}.\end{array}\end{eqnarray} \tag{ A9 }$$

To operate a Pauli twirl on ${P}_{{\mu }_{2}}$ and ${P}_{{\nu }_{2}}$, we rewrite ${U}_{1}^{{\prime} }$ as $\left({\otimes }_{i}\,{Z}^{{\alpha }_{i,1}}{X}^{{\alpha }_{1,i}^{{\prime} }}\right){U}_{1}^{}$ and ${U}_{2}^{{\prime\prime} }{\widehat{{cZ}}}_{1}$ as ${U}_{2}^{{\prime} }{\widehat{{cZ}}}_{1}\left({\otimes }_{i}\,{X}^{{\alpha }_{1,i}^{{\prime} }}{Z}^{{\alpha }_{i,1}}\right)$, see Routine 1. Summing over ${\alpha }_{i,1}$ and ${\alpha }_{i,1}^{{\prime} }$ and using the Pauli Twirl, we obtain ${\delta }_{{\mu }_{2},{\nu }_{2}}$, and thus

$$\begin{eqnarray}\begin{array}{rcl}\rho \left({{ \mathcal U }}_{1}^{},{{ \mathcal U }}_{2}^{{\prime} }\right) & = & \displaystyle \frac{1}{{2}^{2n}}\displaystyle \sum _{\{{\alpha }_{i,1}\},\{{\alpha }_{i,1}^{{\prime} }\}}\rho \left({{ \mathcal U }}_{1}^{{\prime} },{{ \mathcal U }}_{2}^{{\prime\prime} }\right)\\ & = & \displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3}}}{{\nu }_{3}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\mu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\nu }_{3}}^{* (M)}\right){P}_{{\mu }_{3}}{U}_{2}^{{\prime} }{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{}{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{\dagger }{P}_{{\mu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{{\prime} \dagger }{P}_{{\nu }_{3}}.\end{array}\end{eqnarray} \tag{ A10 }$$

To operate a Pauli twirl on ${P}_{{\mu }_{3}}$ and ${P}_{{\nu }_{3}}$ we write the state of the system after the measurements:

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{\mathrm{meas}}\left({{ \mathcal U }}_{1}^{},{{ \mathcal U }}_{2}^{{\prime} }\right)=\displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\{{s}_{i}\}}{\otimes }_{i}\,\left(\langle +{| }_{i}{Z}_{i}^{{s}_{i}}\ \rho \left({{ \mathcal U }}_{1}^{},{{ \mathcal U }}_{2}^{{\prime} }\right)\ {Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\right)\ {Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}}\\ \quad =\,\displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3},{\nu }_{3}}}{{s}_{1},\ldots ,{s}_{n}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\mu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\nu }_{3}}^{* (M)}\right)\\ \quad \times \langle +{| }^{\otimes n}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right){P}_{{\mu }_{3}}{U}_{2}^{{\prime} }{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{}{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{\dagger }{P}_{{\mu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{{\prime} \dagger }{P}_{{\nu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right)| +{\rangle }^{\otimes n}\times \left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}}\right)\\ \quad =\,\displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3},{\nu }_{3}}}{{s}_{1},\ldots ,{s}_{n}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\mu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\nu }_{3}}^{* (M)}\right)\\ \quad \times \,\langle +{| }^{\otimes n}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right){P}_{{\mu }_{3}}\left({\otimes }_{i}\,{X}_{i}^{{\alpha }_{i,2}^{{\prime} }}{Z}_{i}^{{\alpha }_{i,2}}\right){U}_{2}^{}{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{}{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{\dagger }{P}_{{\mu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{\dagger }\left({\otimes }_{i}\,{X}_{i}^{{\alpha }_{i,2}^{{\prime} }}{Z}_{i}^{{\alpha }_{i,2}}\right){P}_{{\nu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right)| +{\rangle }^{\otimes n}\\ \quad \times \left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}}\right),\end{array}\end{eqnarray} \tag{ A11 }$$

where in the second equality we used ${U}_{2}^{{\prime} }=\left({\otimes }_{i}\,{X}_{i}^{{\alpha }_{i,2}^{{\prime} }}{Z}_{i}^{{\alpha }_{i,2}}\right){U}_{2}^{}$ . We can now rewrite ${\left|+\right\rangle }^{\otimes n}$ as ${\otimes }_{i}\,{X}_{i}^{{\alpha }_{i,2}^{{\prime\prime} }}{\left|+\right\rangle }^{\otimes n}$ and sum over $\{{\alpha }_{i,2}^{{\prime} }\}$. Using the Restricted Pauli Twirl (the Pauli-X components of both ${P}_{{\mu }_{3}}$ and ${P}_{{\nu }_{3}}$ stabilize $| +{\rangle }^{\otimes n}$ and can thus be ignored), we obtain ${\delta }_{{\mu }_{3},{\nu }_{3}}$:

$$\begin{eqnarray}\begin{array}{rcl}{\rho }_{\mathrm{meas}}\left({{ \mathcal U }}_{1}^{},{{ \mathcal U }}_{2}^{}\right) & = & \displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{{\alpha }_{i,2}^{{\prime} }}{\rho }_{\mathrm{meas}}\left({{ \mathcal U }}_{1}^{},{{ \mathcal U }}_{2}^{{\prime} }\right)\\ & = & \displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3},{\nu }_{3}}}{{s}_{1},\ldots ,{s}_{n}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\mu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\mu }_{3}}^{* (M)}\right)\\ & & \times \langle +{| }^{\otimes n}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right){P}_{{\mu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{\alpha }_{i,2}}\right){U}_{2}^{}{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{}{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{\dagger }{P}_{{\mu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{\dagger }\left({\otimes }_{i}\,{Z}_{i}^{{\alpha }_{i,2}}\right){P}_{{\mu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right)| +{\rangle }^{\otimes n}\\ & & \times {\otimes }_{i}\,{Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}}.\end{array}\end{eqnarray} \tag{ A12 }$$

Finally, after the classical post-processing (which replaces the outputs s_i with ${s}_{i}\oplus {\alpha }_{i,2}$), average over $\{{\alpha }_{i,2}\}$ yields the outcome state

$$\begin{eqnarray}\begin{array}{rcl}{\rho }_{\mathrm{out}}\left({{ \mathcal U }}_{1}^{},\ {{ \mathcal U }}_{2}^{}\right) & = & \displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\{{\alpha }_{i,2}\}}\displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3}}}{{s}_{1},\ldots ,{s}_{n}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\mu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\mu }_{3}}^{* (M)}\right)\\ & & \times \langle +{| }^{\otimes n}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right){P}_{{\mu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{\alpha }_{i,2}}\right){U}_{2}^{}{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{}{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{\dagger }{P}_{{\mu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{\dagger }\left({\otimes }_{i}\,{Z}_{i}^{{\alpha }_{i,2}}\right){P}_{{\mu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right)| +{\rangle }^{\otimes n}\\ & & \times {\otimes }_{i}\,{Z}_{i}^{{s}_{i}\oplus {\alpha }_{i,2}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}\oplus {\alpha }_{i,2}}\\ & = & \displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\{{\alpha }_{i,2}\}}\displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{\genfrac{}{}{0em}{}{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{{\mu }_{1},{\mu }_{2},{\mu }_{3}}}{{s}_{1},\ldots ,{s}_{n}}}\left({\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\mu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\mu }_{3}}^{* (M)}\right)\\ & & \times \langle +{| }^{\otimes n}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}\oplus {\alpha }_{i,2}}\right){P}_{{\mu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{\alpha }_{i,2}}\right){U}_{2}^{}{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{}{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{\dagger }{P}_{{\mu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{\dagger }\left({\otimes }_{i}\,{Z}_{i}^{{\alpha }_{i,2}}\right){P}_{{\mu }_{3}}\\ & & \times \left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}\oplus {\alpha }_{i,2}}\right)| +{\rangle }^{\otimes n}\\ & & \times {\otimes }_{i}\,{Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}}\\ & = & \displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{{\mu }_{1},{\mu }_{2},{\mu }_{3}}{{s}_{1},\ldots ,{s}_{n}}}\left(\displaystyle \sum _{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\mu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\mu }_{3}}^{* (M)}\right)\\ & & \times \langle +{| }^{\otimes n}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right){P}_{{\mu }_{3}}{U}_{2}^{}{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{}{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{\dagger }{P}_{{\mu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{\dagger }{P}_{{\mu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right)| +{\rangle }^{\otimes n}\\ & & \times {\otimes }_{i}\,{Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}}\\ & = & \displaystyle \frac{1}{{2}^{n}}\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{{\mu }_{1},{\mu }_{2},{\mu }_{3}}{{s}_{1},\ldots ,{s}_{n}}}{\phi }_{{\mu }_{1},{\mu }_{2},{\mu }_{3}}\ \langle +{| }^{\otimes n}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right){P}_{{\mu }_{3}}{U}_{2}^{}{\widehat{{cZ}}}_{1}{P}_{{\mu }_{2}}{U}_{1}^{}{P}_{{\mu }_{1}}\left({\rho }_{{\rm{in}}}\right){P}_{{\mu }_{1}}{U}_{1}^{\dagger }{P}_{{\mu }_{2}}{\widehat{{cZ}}}_{1}{U}_{2}^{\dagger }{P}_{{\mu }_{3}}\left({\otimes }_{i}\,{Z}_{i}^{{s}_{i}}\right)| +{\rangle }^{\otimes n}\\ & & \times {\otimes }_{i}\,{Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}},\end{array}\end{eqnarray} \tag{ A13 }$$

where

$$\begin{eqnarray}&&{\phi }_{{\mu }_{1},{\mu }_{2},{\mu }_{3}}=\displaystyle \sum _{p,{k}_{1},{k}_{2},{l}_{1},{l}_{2}}{\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{\eta }_{{l}_{2},0,{\mu }_{1}}^{* (R)}{\eta }_{{l}_{1},{l}_{2},{\mu }_{2}}^{* (F)}{\eta }_{p,{l}_{1},{\mu }_{3}}^{* (M)}=\displaystyle \sum _{p}{\left|\displaystyle \sum _{{k}_{1},{k}_{2}}{\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}\right|}^{2}\geqslant 0\ \end{eqnarray} \tag{ A14 }$$

and ${\sum }_{{\mu }_{1},{\mu }_{2},{\mu }_{3}}{\phi }_{{\mu }_{1},{\mu }_{2},{\mu }_{3}}=1$. ${\rho }_{\mathrm{out}}\left({{ \mathcal U }}_{1},\ {{ \mathcal U }}_{2}^{}\right)$ is therefore a convex combination of quantum states and ${\phi }_{{\mu }_{1},{\mu }_{2},{\mu }_{3}}$ can be seen as the joint probability of Pauli errors ${P}_{{\mu }_{1}},{P}_{{\mu }_{2}}$ and ${P}_{{\mu }_{3}}$. We can thus rewrite

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}\left({{ \mathcal U }}_{1},{{ \mathcal U }}_{2}\right)=\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{{{ \mathcal P }}_{0},{{ \mathcal P }}_{1},{{ \mathcal P }}_{2}}{{s}_{1},\ldots ,{s}_{n}}}\displaystyle \frac{\mathrm{prob}\left({{ \mathcal P }}_{0},{{ \mathcal P }}_{1},{{ \mathcal P }}_{2}\right)}{{2}^{n}}\ \ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{\overline{s}}{{ \mathcal P }}_{2}\ {{ \mathcal U }}_{2}\ { \mathcal C }{{ \mathcal Z }}_{1}\ {{ \mathcal P }}_{1}\ {{ \mathcal U }}_{1}\ {{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\left({\otimes }_{i}{Z}_{i}^{{s}_{i}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}}\right),\end{eqnarray} \tag{ A15 }$$

where ${{ \mathcal P }}_{0},{{ \mathcal P }}_{2}\in \{{ \mathcal I },{ \mathcal Z }\}{}^{\otimes n}$, ${{ \mathcal P }}_{1}\in \{{ \mathcal I },{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}{}^{\otimes n}$ and $\mathrm{prob}\left({{ \mathcal P }}_{0},{{ \mathcal P }}_{1},{{ \mathcal P }}_{2}\right)$ is the joint probability of Pauli errors ${{ \mathcal P }}_{0},{{ \mathcal P }}_{1},{{ \mathcal P }}_{2}$. This concludes the proof for the protocol with v = 0 and m = 2.

The generalization to a protocol with v = 0 and $m\gt 2$ is straightforward. Starting from the state in equation (A4), one can use the same arguments as for the two-band circuit. To generalize to multiple circuits ($v\gt 0$), we start by noticing that the circuits are implemented in series, hence the noise can only affect one circuit at a time. By the principle of deferred measurements, we can execute all the measurements at the end of the protocol. Moreover, we can prepare the input qubits for all the circuits at the beginning of the protocol. Doing this, the state of the system after all circuits have been implemented becomes

$$\begin{eqnarray}&&\begin{array}{l}\rho \left({{ \mathcal U }}_{1}^{{\prime\prime} (1)},\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} (v+1)}\right)={\mathrm{Tr}}_{{\rm{E}}}\left[\left({{\bf{M}}}^{(v+1)}\ {U}_{m}^{{\prime\prime} (v+1)}{\widehat{{cZ}}}_{m-1}{{\bf{F}}}_{m-1}^{(v+1)}{U}_{m-1}^{{\prime\prime} (v+1)}\ldots {\widehat{{cZ}}}_{1}{{\bf{F}}}_{v+1}^{(1)}{U}_{1}^{{\prime\prime} (v+1)}{{\bf{R}}}^{(v+1)}\right)\ldots \right.\\ \quad \left({{\bf{M}}}^{(1)}\ {U}_{m}^{{\prime\prime} (1)}{\widehat{{cZ}}}_{m-1}{{\bf{F}}}_{m-1}^{(1)}{U}_{m-1}^{{\prime\prime} (1)}\ldots {\widehat{{cZ}}}_{1}{{\bf{F}}}_{1}^{(1)}{U}_{1}^{{\prime\prime} (1)}{{\bf{R}}}^{(1)}\right)\\ \quad \left({\rho }_{{\rm{in}}}\otimes {\rho }_{E}\right)\left({{\bf{R}}}^{\dagger (1)}{U}_{1}^{{\prime\prime} \dagger (1)}{{\bf{F}}}_{1}^{\dagger (1)}{\widehat{{cZ}}}_{1}\ldots {U}_{m-1}^{{\prime\prime} \dagger (1)}{{\bf{F}}}_{m-1}^{\dagger (1)}{\widehat{{cZ}}}_{m-1}{U}_{m}^{{\prime\prime} \dagger (1)}{{\bf{M}}}^{\dagger (1)}\right)\ldots \\ \quad \left({{\bf{R}}}^{\dagger (v+1)}{U}_{1}^{{\prime\prime} \dagger (v+1)}{{\bf{F}}}_{1}^{\dagger (v+1)}{\widehat{{cZ}}}_{1}\ldots {U}_{m-1}^{{\prime\prime} \dagger (v+1)}{{\bf{F}}}_{m-1}^{\dagger (v+1)}\left.{\widehat{{cZ}}}_{m-1}{U}_{m}^{{\prime\prime} \dagger (v+1)}{{\bf{M}}}^{\dagger (v+1)}\right)\right],\end{array}\end{eqnarray} \tag{ A16 }$$

where ${\rho }_{\mathrm{in}}={\otimes }_{k=1}^{v+1}{\otimes }_{i=1}^{n}| +{\rangle }_{i}^{(k)}\langle +|$, ${{\bf{R}}}^{(k)},{{\bf{F}}}_{j}^{(k)},{{\bf{M}}}^{(k)}$ are unitary matrices that act only on the qubits in the kth circuit and on the environment (which is the same for all the circuits) and ${U}_{j}^{{\prime\prime} (k)}={\otimes }_{i}\,{U}_{i,j}^{{\prime\prime} (k)}$. Starting from here and using the same arguments as above, one can finally obtain equation (A1).□

Table 1.  Operators appearing in equation (A6).

$\langle {e}_{{k}_{2}}| {\bf{R}}| {e}_{0}\rangle ={\sum }_{{\mu }_{1}}{\eta }_{{k}_{2},0,{\mu }_{1}}^{(R)}{P}_{{\mu }_{1}}$	$\langle {e}_{{k}_{1}}| {{\bf{F}}}_{1}| {e}_{{k}_{2}}\rangle ={\sum }_{{\mu }_{2}}{\eta }_{{k}_{1},{k}_{2},{\mu }_{2}}^{(F)}{P}_{{\mu }_{2}}$	$\langle {e}_{p}| {\bf{M}}| {e}_{{k}_{1}}\rangle ={\sum }_{{\mu }_{3}}{\eta }_{p,{k}_{1},{\mu }_{3}}^{(M)}{P}_{{\mu }_{3}}$
$\langle {e}_{0}| {{\bf{R}}}^{\dagger }| {e}_{{l}_{2}}\rangle ={\sum }_{{\nu }_{1}}{\eta }_{{l}_{2},0,{\nu }_{1}}^{* (R)}{P}_{{\nu }_{1}}$	$\langle {e}_{{l}_{2}}| {{\bf{F}}}_{1}^{\dagger }| {e}_{{l}_{1}}\rangle ={\sum }_{{\nu }_{2}}{\eta }_{{l}_{1},{l}_{2},{\nu }_{2}}^{* (F)}{P}_{{\nu }_{2}}$	$\langle {e}_{{l}_{1}}| {{\bf{M}}}^{\dagger }| {e}_{p}\rangle ={\sum }_{{\nu }_{3}}{\eta }_{p,{l}_{1},{\nu }_{3}}^{* (M)}{P}_{{\nu }_{3}}$

Lemma 1 shows that in our accreditation protocol the noise of the form N1 can be reduced to classically correlated collections of Pauli errors affecting the circuits. In this appendix we prove lemma 2, which states that all collections of Pauli errors can be detected with probability larger than 1/4. More formally:

Lemma 2. For any collection of Pauli errors affecting a trap circuit, summing over all possible single-qubit gates in the trap circuit (i.e. over all possible sets $\{{U}_{i,j}\}$ output by Routine 2), the probability that the trap circuit outputs $\overline{s}=\overline{0}$ is at most 3/4.

Proof. For a given collection of Pauli errors $\{{{ \mathcal P }}_{j}\}{}_{j=0}^{m}$ affecting a trap circuit, the state of the trap circuit after the measurements is of the form

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}^{\mathrm{trap}}\left(\{{{ \mathcal P }}_{j}\}\right)=\displaystyle \frac{1}{{M}_{1}\,\times \cdots \times \,{M}_{m-1}}\displaystyle \sum _{{{ \mathcal U }}_{1},\cdots ,{{ \mathcal U }}_{m}}{{ \mathcal P }}_{m}{{ \mathcal U }}_{m}\,\circ \,\left({\circ }_{j=1}^{m-1}{ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}{{ \mathcal U }}_{j}\right)\,\circ \,{{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right),\end{eqnarray} \tag{ B1 }$$

where ${\rho }_{\mathrm{in}}^{\mathrm{trap}}={\otimes }_{i=1}^{n}| +{\rangle }_{i}\langle +|$, ${ \mathcal C }{{ \mathcal Z }}_{j}$ is the entangling operation in band j, ${{ \mathcal P }}_{0},{{ \mathcal P }}_{m}\in \{{ \mathcal I },{ \mathcal Z }\}{}^{\otimes n}$, ${{ \mathcal P }}_{j}\in \{{ \mathcal I },{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}{}^{\otimes n}$ for all j = 1,...,m and M_j is the number of choices of ${{ \mathcal U }}_{j}$. Note that each number M_j depends on the number of qubits connected by a cZ in band j of the trap circuit, see Routine 2.

In a trap circuit the gate ${{ \mathcal U }}_{1}$ in the first band is of the form ${{ \mathcal U }}_{1}={{ \mathcal V }}_{1}{{ \mathcal H }}^{t}$, where ${{ \mathcal V }}_{1}$ implements a gate from $\{H,S\}{}^{\otimes n}$ (see step 2.1 of Routine 2) and ${{ \mathcal H }}^{t}$ is the round of Hadamard gates activated at random (see step 3 of Routine 2). Similarly, for all $j=2,\ldots ,m-1$, ${{ \mathcal U }}_{j}$ implements a gate belonging to the set $\{I,{{HS}}^{\dagger },{SH}\}{}^{\otimes n}$. These gates undo the gates in previous band and implement new ones (see step 2.1 Routine 2 and figure 3), thus we can write them as ${{ \mathcal U }}_{j}={{ \mathcal V }}_{j}{{ \mathcal V }}_{j-1}^{-1}$—with each ${{ \mathcal V }}_{j}$ implementing a gate from the set $\{H,S\}{}^{\otimes n}$. Finally, the gate ${{ \mathcal U }}_{m}$ in the last band is of the form ${{ \mathcal U }}_{m}={{ \mathcal H }}^{t}{{ \mathcal V }}_{m-1}^{-1}$, where ${{ \mathcal V }}_{m-1}^{-1}$ implements a gate from $\{H,{S}^{\dagger }\}{}^{\otimes n}$ and undoes the gate in band $m-1$ (see step 2.2 of Routine 2). Using this, we obtain

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}^{\mathrm{trap}}\left(\{{{ \mathcal P }}_{j}\}\right)=\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}\,\times \cdots \times \,{N}_{m-1}}\displaystyle \sum _{{{ \mathcal V }}_{1},\cdots ,{{ \mathcal V }}_{m-1}}{{ \mathcal P }}_{m}{{ \mathcal H }}^{t}\,\circ \,\left({\circ }_{j=1}^{m-1}{{ \mathcal V }}_{j}^{-1}{ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}{{ \mathcal V }}_{j}\right)\,\circ \,{{ \mathcal H }}^{t}{{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right),\end{eqnarray} \tag{ B2 }$$

where N_j is the number of possible choices of ${{ \mathcal V }}_{j}$.

Using that ${{ \mathcal V }}_{j}^{-1}{ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal V }}_{j}={ \mathcal C }{{ \mathcal X }}_{j}$ is a tensor product of cX gates, the above state can also be rewritten as

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}^{\mathrm{trap}}\left(\{{{ \mathcal P }}_{j}\}\right)=\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}\,\times \cdots \times \,{N}_{m-1}}\displaystyle \sum _{{{ \mathcal V }}_{1},\cdots ,{{ \mathcal V }}_{m-1}}{{ \mathcal P }}_{m}{{ \mathcal H }}^{t}\,\circ \,\left({\circ }_{j=1}^{m-1}{ \mathcal C }{{ \mathcal X }}_{j}{{ \mathcal V }}_{j}^{-1}{{ \mathcal P }}_{j}{{ \mathcal V }}_{j}\right)\,\circ \,{{ \mathcal H }}^{t}{{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right).\end{eqnarray} \tag{ B3 }$$

Notice that each ${ \mathcal C }{{ \mathcal X }}_{j}$ carries an implicit dependency on ${{ \mathcal V }}_{j}$ (the orientation of the cX gates depends on ${{ \mathcal V }}_{j}$, see Figure 3).

The probability that the trap outputs $\overline{s}=\overline{0}$ is

$$\begin{eqnarray}&&\mathrm{prob}\left(\overline{s}=\overline{0}| \{{{ \mathcal P }}_{j}\}\right)=\langle +{| }^{\otimes n}{\rho }_{\mathrm{out}}^{\mathrm{trap}}\left(\{{{ \mathcal P }}_{j}\}\right)| +{\rangle }^{\otimes n}.\end{eqnarray} \tag{ B4 }$$

To upper-bound this probability by 3/4, we first consider 'single-band' collections of errors, namely collections $\{{{ \mathcal P }}_{j}\}$ such that ${{ \mathcal P }}_{{j}_{0}}\ne { \mathcal I }$ for some ${j}_{0}\in \{0,\ldots ,m\}$ and ${{ \mathcal P }}_{j}={ \mathcal I }$ for all other $j\ne {j}_{0}$. For these collections, we prove that the probability that the output of the trap is the correct one $\overline{s}=\overline{0}$ is smaller than 1/2:

$$\begin{eqnarray}&&\mathrm{prob}(\overline{s}=\overline{0}| \mathrm{single}-\mathrm{band}\ \mathrm{collection})\leqslant \displaystyle \frac{1}{2}.\end{eqnarray} \tag{ B5 }$$

We prove this in Statement 1.

Next, we consider 'two-band' collections of errors. We obtain

$$\begin{eqnarray}&&\mathrm{prob}(\bar{s}=\bar{0}| \mathrm{two}-\mathrm{band}\ \mathrm{collection})\leqslant \frac{3}{4}.\end{eqnarray} \tag{ B6 }$$

We prove this in Statement 2. To obtain this bound, we move the two errors towards each other (i.e. we commute them with all the gates in the middle) and subsequently merge them, rewriting them as a single Pauli operator. The resulting Pauli operator is the identity ${ \mathcal I }$ with probability c, or is a different operator with probability $1-c$. In the former case, the errors have canceled out with each other, while in the latter they have reduced to a single-band error. Importantly, in Statement 2 we prove that $c\leqslant 1/2$. This yields

$$\begin{eqnarray*}&&\mathrm{prob}(\bar{s}=\bar{0}| \mathrm{two}-\mathrm{band}\ \mathrm{collection})=(1-c)\mathrm{prob}(\bar{s}=\bar{0}| \mathrm{single}-\mathrm{band}\,\mathrm{collection})+c\ \mathrm{prob}(\bar{s}=\bar{0}| \mathrm{no}\,\mathrm{error})\end{eqnarray*}$$

$$\begin{eqnarray}&&\leqslant \displaystyle \frac{1-c}{2}+c=\displaystyle \frac{1}{2}+\displaystyle \frac{c}{2},\end{eqnarray} \tag{ B7 }$$

where we used $\mathrm{prob}(\bar{s}=\bar{0}| \mathrm{no}\,\mathrm{error})=1$ and $\mathrm{prob}(\bar{s}=\bar{0}| \mathrm{single}-\mathrm{band}\,\mathrm{collection})\leqslant 1/2$. Maximizing over $c\in [0,1/2]$, we find

$$\begin{eqnarray}&&\mathrm{prob}(\overline{s}=\overline{0}| \mathrm{two}-\mathrm{band}\ \mathrm{collection})\leqslant \mathop{\max }\limits_{0\leqslant c\leqslant \tfrac{1}{2}}\left(\displaystyle \frac{1}{2}+\displaystyle \frac{c}{2}\right)=\displaystyle \frac{3}{4}.\end{eqnarray} \tag{ B8 }$$

Finally, we generalise to collections affecting more than two bands. For three-band collections, again we move two of these Pauli operators towards each other and merge them. Doing this, the three-band collection reduces to a single-band one with probability $c\leqslant 1/2$ or to a two-band one with probability $1-c$. Thus, using the above results, we have

$$\begin{eqnarray*}&&\mathrm{prob}(\bar{s}=\bar{0}| \mathrm{three}-\mathrm{band}\,\mathrm{collection})=(1-c)\mathrm{prob}(\bar{s}=\bar{0}| \mathrm{two}-\mathrm{band}\,\mathrm{collection})+c\mathrm{prob}(\bar{s}=\bar{0}| \mathrm{single}-\mathrm{band}\,\mathrm{collection})\end{eqnarray*}$$

$$\begin{eqnarray}&&\leqslant \displaystyle \frac{3(1-c)}{4}+\displaystyle \frac{c}{2}\leqslant \mathop{\max }\limits_{0\leqslant c\leqslant \tfrac{1}{2}}\left(\displaystyle \frac{3(1-c)}{4}+\displaystyle \frac{c}{2}\right)=\displaystyle \frac{3}{4}.\end{eqnarray} \tag{ B9 }$$

This argument can be iterated: at any fixed h, if $\mathrm{prob}(\bar{s}=\bar{0}| (h-2)-\mathrm{band}\,\mathrm{collection})\leqslant 3/4$ and $\mathrm{prob}(\bar{s}=\bar{0}| (h-1)-\mathrm{band}\,\mathrm{collection})\leqslant 3/4$, then it can be easily shown that $\mathrm{prob}(\bar{s}=\bar{0}| h-\mathrm{band}\,\mathrm{collection})\leqslant 3/4$. We now complete the proof by proving Statement 1 and Statement 2.

Statement 1. Single-band collections are defined as follows:

$$\begin{eqnarray}&&{{ \mathcal P }}_{j}\ne { \mathcal I }\,\mathrm{for}\,j={j}_{0}\in \{0,\cdots ,m\},{{ \mathcal P }}_{j}={ \mathcal I }\ \mathrm{for}\ \mathrm{all}\ j\ne {j}_{0}.\end{eqnarray} \tag{ B10 }$$

If ${j}_{0}=0$, using ${cX}| ++\rangle =| ++\rangle$ and ${cX}| 00\rangle =| 00\rangle$, we have

$$\begin{eqnarray}\begin{array}{rcl}\mathrm{prob}\left(\overline{s}=\overline{0}| \{{{ \mathcal P }}_{j}\}\right) & = & \displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\langle +{| }^{\otimes n}{{ \mathcal H }}^{t}\,\circ \,\left({\circ }_{j=1}^{m}{ \mathcal C }{{ \mathcal X }}_{j}\right)\circ {{ \mathcal H }}^{t}{{ \mathcal P }}_{0}| +{\rangle }^{\otimes n}\\ & = & \langle +{| }^{\otimes n}{{ \mathcal P }}_{0}| +{\rangle }^{\otimes n}=0,\end{array}\end{eqnarray} \tag{ B11 }$$

since ${{ \mathcal P }}_{0}\ne { \mathcal I }\in \{{ \mathcal I },{ \mathcal Z }\}{}^{\otimes n}$, and the same happens for ${{ \mathcal P }}_{m}\ne { \mathcal I }$.

If $1\leqslant {j}_{0}\leqslant m-1$, we have

$$\begin{eqnarray}&&\mathrm{prob}\left(\overline{s}=\overline{0}| \{{{ \mathcal P }}_{j}\}\right)=\displaystyle \frac{1}{{N}_{{j}_{0}}}\displaystyle \sum _{{{ \mathcal V }}_{{j}_{0}}}\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\langle +{| }^{\otimes n}{{ \mathcal H }}^{t}{{ \mathcal V }}_{{j}_{0}}^{-1}{{ \mathcal P }}_{{j}_{0}}{{ \mathcal V }}_{{j}_{0}}{{ \mathcal H }}^{t}| +{\rangle }^{\otimes n},\end{eqnarray} \tag{ B12 }$$

where we used again that ${cX}| ++\rangle =| ++\rangle$ and ${cX}| 00\rangle =| 00\rangle$. Notice that $\langle +{| }^{\otimes n}{ \mathcal P }| +{\rangle }^{\otimes n}=0$ for all Pauli operators P whose Pauli-Z component is non-trivial, therefore ${\sum }_{t}\langle +{| }^{\otimes n}{{ \mathcal H }}^{t}{ \mathcal P }{{ \mathcal H }}^{t}| +{\rangle }^{\otimes n}/2\leqslant 1/2$ for all ${ \mathcal P }\in \{{ \mathcal I },{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}{}^{\otimes n}/{ \mathcal I }$. This yields

$$\begin{eqnarray}&&\mathrm{prob}\left(\overline{s}=\overline{0}| \{{{ \mathcal P }}_{j}\}\right)\leqslant \displaystyle \frac{1}{{N}_{{j}_{0}}}\displaystyle \sum _{{{ \mathcal V }}_{{j}_{0}}}\displaystyle \frac{1}{2}\leqslant \displaystyle \frac{1}{2}{\rm{}}\,,\end{eqnarray} \tag{ B13 }$$

where we used that ${{ \mathcal V }}_{{j}_{0}}^{-1}{{ \mathcal P }}_{{j}_{0}}{{ \mathcal V }}_{{j}_{0}}$ is a Pauli operator for any ${{ \mathcal V }}_{{j}_{0}}$, as this ${{ \mathcal V }}_{{j}_{0}}$ implements a gate from the set $\{H,S\}{}^{\otimes n}$.

Statement 2. Two-band collections are defined as follows:

$$\begin{eqnarray}&&{{ \mathcal P }}_{j}\ne { \mathcal I }\,\mathrm{for}\,j={j}_{1},{j}_{2}\in \{0,\cdots ,m\}(\mathrm{with}\,{j}_{1}\lt {j}_{2}),{{ \mathcal P }}_{j}={ \mathcal I }\ \mathrm{for}\ \mathrm{all}\ j\ne {j}_{1},{j}_{2}.\end{eqnarray} \tag{ B14 }$$

We can distinguish four classes of two-band collections:

• (1)  
  Errors in state preparation and entangling gates, i.e. ${j}_{1}=0$ and $1\leqslant {j}_{2}\leqslant m-1$.
• (2)  
  Errors in entangling gates and measurements, i.e. $1\leqslant {j}_{1}\leqslant m-1$ and ${j}_{2}=m$.
• (3)  
  Errors in two different entangling gates, i.e. $1\leqslant {j}_{1}\lt {j}_{2}\leqslant m-1$.
• (4)  
  Errors in state preparation and measurements, i.e. ${j}_{1}=0$ and ${j}_{2}=m$.

Errors in class 1 yield $\overline{s}=\overline{0}$ with probability at most 3/4. To prove this, we start by rewriting this probability as

$$\begin{eqnarray}&&\begin{array}{l}\mathrm{prob}\left(\overline{s}=\overline{0}| \{{P}_{j}\}\right)=\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}\,\times \cdots \times \,{N}_{m-1}}\\ \times \,\displaystyle \sum _{{{ \mathcal V }}_{1},\cdots ,{{ \mathcal V }}_{m-1}}\langle +{| }^{\otimes n}{{ \mathcal H }}^{t}\,\circ \,\left({\circ }_{j={j}_{2}}^{m-1}{ \mathcal C }{{ \mathcal X }}_{j}\right)\circ {{ \mathcal V }}_{{j}_{2}}^{-1}{{ \mathcal P }}_{{j}_{2}}{{ \mathcal V }}_{{j}_{2}}\circ \left({\circ }_{j=1}^{{j}_{2}-1}{ \mathcal C }{{ \mathcal X }}_{j}\right)\,\circ \,{{ \mathcal H }}^{t}{{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right)| +{\rangle }^{\otimes n}\ \\ \quad =\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}\,\times \cdots \times \,{N}_{m-1}}\displaystyle \sum _{{{ \mathcal V }}_{1},\cdots ,{{ \mathcal V }}_{{j}_{2}}}\langle +{| }^{\otimes n}{{ \mathcal H }}^{t}{{ \mathcal V }}_{{j}_{2}}^{-1}{{ \mathcal P }}_{{j}_{2}}{{ \mathcal V }}_{{j}_{2}}\,\circ \,\left({\circ }_{j=1}^{{j}_{2}-1}{ \mathcal C }{{ \mathcal X }}_{j}\right)\,\circ \,{{ \mathcal H }}^{t}{{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right)| +{\rangle }^{\otimes n},\end{array}\end{eqnarray} \tag{ B15 }$$

where we used ${cX}| ++\rangle =| ++\rangle$ and ${cX}| 00\rangle =| 00\rangle$. We now start from the case ${j}_{2}=1$. We then note that (i) if n = 1 (single-qubit circuit), all ${{ \mathcal P }}_{1}\in \{{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}$ and all ${{ \mathcal P }}_{0}={ \mathcal Z }$ lead to

$$\begin{eqnarray}&&\mathrm{prob}\left(\overline{s}=\overline{0}| \{{P}_{j}\},1\,\mathrm{qubit}\right)=\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}}\displaystyle \sum _{{{ \mathcal V }}_{1}\in \{{ \mathcal H },{ \mathcal S }\}}\langle +{| }^{}{{ \mathcal H }}^{t}{{ \mathcal V }}_{1}^{-1}{{ \mathcal P }}_{1}{{ \mathcal V }}_{1}{{ \mathcal H }}^{t}{{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right)| +{\rangle }^{}\leqslant \displaystyle \frac{3}{4},\end{eqnarray} \tag{ B16 }$$

and (ii) if n = 2 (two-qubit circuit) and in band 1 the two qubits are connected by cZ, all ${{ \mathcal P }}_{1}\ne { \mathcal I }\in \{{ \mathcal I },{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}{}^{\otimes 2}$ and all ${{ \mathcal P }}_{0}\ne { \mathcal I }\in \{{ \mathcal I },{ \mathcal Z }\}{}^{\otimes 2}$ lead to

$$\begin{eqnarray}&&\mathrm{prob}\left(\overline{s}=\overline{0}| \{{P}_{j}\},2\mathrm{qubits}\right)=\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}}\displaystyle \sum _{{{ \mathcal V }}_{1}\in \{{ \mathcal H }\otimes { \mathcal S },{ \mathcal S }\otimes { \mathcal H }\}}\langle +{| }^{\otimes 2}{{ \mathcal H }}^{t}{{ \mathcal V }}_{1}^{-1}{{ \mathcal P }}_{1}{{ \mathcal V }}_{1}{{ \mathcal H }}^{t}{{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right)| +{\rangle }^{\otimes 2}\leqslant \displaystyle \frac{3}{4}.\end{eqnarray} \tag{ B17 }$$

The above inequalities for n = 1 and n = 2 can be proven using that H maps $\{X,Y,Z\}$ into $\{Z,Y,X\}$ under conjugation and S maps $\{X,Y,Z\}$ into $\{Y,X,Z\}$ under conjugation (apart from unimportant global phases). Extension to more than two qubits is as follows: If $\mathrm{prob}\left(\overline{s}=\overline{0}| \{{P}_{j}\},{n}_{0}\mathrm{qubits}\right)\leqslant 3/4$, then tensoring one more qubit yields

$$\begin{eqnarray}&&\begin{array}{l}\mathrm{prob}\left(\overline{s}=\overline{0}| \{{P}_{j}\},{n}_{0}+1\,\mathrm{qubits}\right)\\ \quad =\,\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}}\displaystyle \sum _{{{ \mathcal V }}_{1}}\left(\langle +{| }^{\otimes {n}_{0}}{{ \mathcal H }}_{1,\ldots ,{n}_{0}}^{t}{{ \mathcal V }}_{1| 1,\ldots ,{n}_{0}}^{-1}{{ \mathcal P }}_{1| 1,\ldots ,{n}_{0}}{{ \mathcal V }}_{1| 1,\ldots ,{n}_{0}}{{ \mathcal H }}_{1,\ldots ,{n}_{0}}^{t}{{ \mathcal P }}_{0| 1,\ldots ,{n}_{0}}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right)| +{\rangle }^{\otimes {n}_{0}}\right.\\ \quad \left.\times \,\langle +{| }^{}{{ \mathcal H }}_{{n}_{0}+1}^{t}{{ \mathcal V }}_{1| {n}_{0}+1}^{-1}{{ \mathcal P }}_{1| {n}_{0}+1}{{ \mathcal V }}_{1| {n}_{0}+1}{{ \mathcal H }}_{{n}_{0}+1}^{t}{{ \mathcal P }}_{0| {n}_{0}+1}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right)| +{\rangle }^{}\right),\end{array}\end{eqnarray} \tag{ B18 }$$

where ${{ \mathcal H }}_{1,\ldots ,{n}_{0}}^{t},{{ \mathcal V }}_{1| 1,\ldots ,{n}_{0}},{{ \mathcal P }}_{1| 1,\ldots ,{n}_{0}}$ and ${{ \mathcal P }}_{0| 1,\ldots ,{n}_{0}}$ are the components of ${{ \mathcal H }}^{t},{{ \mathcal V }}_{1},{{ \mathcal P }}_{1}$ and ${{ \mathcal P }}_{0}$ acting on qubits $\{1,\ldots ,{n}_{0}\}$ and ${{ \mathcal H }}_{{n}_{0}+1}^{t},{{ \mathcal V }}_{1| {n}_{0}+1},{{ \mathcal P }}_{1| {n}_{0}+1}$ and ${{ \mathcal P }}_{0| {n}_{0}+1}$ the components acting on qubit ${n}_{0}+1$. Using that if ${A}_{h},{B}_{h}\geqslant 0\forall h$, then ${\sum }_{h}{A}_{h}{B}_{h}\leqslant {\sum }_{h}{A}_{h}{\sum }_{h}{B}_{h}$, we obtain

$$\begin{eqnarray}&&\begin{array}{r}\begin{array}{l}{\rm{p}}{\rm{r}}{\rm{o}}{\rm{b}}\left(\bar{s}=\bar{0}| \{{P}_{j}\},{n}_{0}+1{\rm{q}}{\rm{u}}{\rm{b}}{\rm{i}}{\rm{t}}{\rm{s}}\right)\\ \,\leqslant \,\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}}\displaystyle \sum _{{{ \mathcal V }}_{1}}\left( \langle +{| }^{\otimes {n}_{0}}{{ \mathcal H }}_{1,\ldots ,{n}_{0}}^{t}{{ \mathcal V }}_{1| 1,\ldots ,{n}_{0}}^{-1}{{ \mathcal P }}_{1| 1,\ldots ,{n}_{0}}{{ \mathcal V }}_{1| 1,\ldots ,{n}_{0}}{{ \mathcal H }}_{1,\ldots ,{n}_{0}}^{t}{{ \mathcal P }}_{0| 1,\ldots ,{n}_{0}}\left({\rho }_{{\rm{i}}{\rm{n}}}^{{\rm{t}}{\rm{r}}{\rm{a}}{\rm{p}}}\right)| +{ \rangle }^{\otimes {n}_{0}}\right)\\ \,\times \,\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}}\displaystyle \sum _{{{ \mathcal V }}_{1}}\left( \langle +{| }^{}{{ \mathcal H }}_{{n}_{0}+1}^{t}{{ \mathcal V }}_{1| {n}_{0}+1}^{-1}{{ \mathcal P }}_{1| {n}_{0}+1}{{ \mathcal V }}_{1| {n}_{0}+1}{{ \mathcal H }}_{{n}_{0}+1}^{t}{{ \mathcal P }}_{0| {n}_{0}+1}\left({\rho }_{{\rm{i}}{\rm{n}}}^{{\rm{t}}{\rm{r}}{\rm{a}}{\rm{p}}}\right)| +{ \rangle }^{}\right)\leqslant \,\displaystyle \frac{3}{4}\times \displaystyle \frac{3}{4}\leqslant \displaystyle \frac{3}{4}.\end{array}\end{array}\end{eqnarray} \tag{ B19 }$$

Tensoring two qubits connected by cZ yields the same bound, and this concludes the proof by induction for ${j}_{2}=1$. If ${j}_{2}\in \{1,\ldots ,m-1\}$ the proof is similar, but the Pauli operator ${{ \mathcal V }}_{{j}_{2}}^{-1}{{ \mathcal P }}_{{j}_{2}}{{ \mathcal V }}_{{j}_{2}}$ must be commuted with ${ \mathcal C }{{ \mathcal X }}_{1},\ldots ,{ \mathcal C }{{ \mathcal X }}_{{j}_{2}-1}$ (where we remember that each ${ \mathcal C }{{ \mathcal X }}_{j}$ depends on ${{ \mathcal V }}_{j}$). At fixed ${{ \mathcal V }}_{1},\ldots ,{{ \mathcal V }}_{{j}_{2}-1}$ it can be shown (with the same arguments as used for ${j}_{2}=1$, i.e. considering first the cases n = 1 and n = 2 and then generalizing to $n\gt 2$) that summations over ${{ \mathcal V }}_{{j}_{2}}$ and t yield an upper-bound of 3/4. The upper-bound on $\mathrm{prob}\left(\overline{s}=\overline{0}| \{{P}_{j}\},{n}_{0}+1\,\mathrm{qubits}\right)$ follows by summing over all possible values of ${{ \mathcal V }}_{1},\ldots ,{{ \mathcal V }}_{{j}_{2}-1}$.

Errors in class 2 yield $\overline{s}=\overline{0}$ with probability at most 3/4. This can be proven with the same arguments as for errors in class 1.

Errors in class 3 yield $\overline{s}=\overline{0}$ with probability at most 3/4. To see this, consider first the case where the errors affect neighboring bands (${j}_{2}={j}_{1}+1$), which yields

$$\begin{eqnarray}&&\mathrm{prob}\left(\overline{s}=\overline{0}| \{{{ \mathcal P }}_{j}\}\right)=\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{{j}_{1}}{N}_{{j}_{1}+1}}\displaystyle \sum _{{{ \mathcal V }}_{{j}_{1}},{{ \mathcal V }}_{{j}_{1}+1}}\langle +{| }^{\otimes n}{{ \mathcal H }}^{t}{{ \mathcal V }}_{{j}_{1}+1}^{-1}{{ \mathcal P }}_{{j}_{1}+1}{{ \mathcal V }}_{{j}_{1}+1}{{ \mathcal V }}_{{j}_{1}}^{-1}{{ \mathcal P }}_{{j}_{1}}{{ \mathcal V }}_{{j}_{1}}{{ \mathcal H }}^{t}| +{\rangle }^{\otimes n}\leqslant \displaystyle \frac{3}{4}.\end{eqnarray} \tag{ B20 }$$

As for errors in class 1, this can be shown by proving that the bound holds for the single-qubit case and the two-qubit one, and then using induction. If the errors affect two non-neighboring bands (${j}_{2}\ne {j}_{1}+1$), we have

$$\begin{eqnarray}&&\mathrm{prob}\left(\overline{s}=\overline{0}| \{{{ \mathcal P }}_{j}\}\right)=\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{{j}_{1}}{N}_{{j}_{2}}}\displaystyle \sum _{{{ \mathcal V }}_{{j}_{1}},{{ \mathcal V }}_{{j}_{2}}}\langle +{| }^{\otimes n}{{ \mathcal H }}^{t}{{ \mathcal V }}_{{j}_{2}}^{-1}{{ \mathcal P }}_{{j}_{2}}{{ \mathcal V }}_{{j}_{2}}\left({\circ }_{j={j}_{1}+1}^{{j}_{2}-1}{ \mathcal C }{{ \mathcal X }}_{j}\right){{ \mathcal V }}_{{j}_{1}}^{-1}{{ \mathcal P }}_{{j}_{1}}{{ \mathcal V }}_{{j}_{1}}{{ \mathcal H }}^{t}| +{\rangle }^{\otimes n}\leqslant \displaystyle \frac{3}{4}.\end{eqnarray} \tag{ B21 }$$

To prove the inequality, one can commute ${{ \mathcal V }}_{{j}_{1}}^{-1}{{ \mathcal P }}_{{j}_{1}}{{ \mathcal V }}_{{j}_{1}}$ (which is a Pauli operator) with the entangling operation and use the same arguments as for ${j}_{2}={j}_{1}+1$.

Zoom In Zoom Out Reset image size

Finally, errors in class 4 yield

$$\begin{eqnarray}&&\mathrm{prob}\left(\overline{s}=\overline{0}| \{{P}_{j}\}\right)=\displaystyle \frac{1}{2}\displaystyle \sum _{t=0,1}\displaystyle \frac{1}{{N}_{1}\,\times \cdots \times \,{N}_{m-1}}\displaystyle \sum _{{{ \mathcal V }}_{1},\cdots ,{{ \mathcal V }}_{m-1}}\langle +{| }^{\otimes n}{{ \mathcal P }}_{m}{{ \mathcal H }}^{t}\,\circ \,\left({\circ }_{j=1}^{m-1}{ \mathcal C }{{ \mathcal X }}_{j}\right)\,\circ \,{{ \mathcal H }}^{t}{{ \mathcal P }}_{0}\left({\rho }_{\mathrm{in}}^{\mathrm{trap}}\right)| +{\rangle }^{\otimes n}\leqslant \displaystyle \frac{1}{2}.\end{eqnarray} \tag{ B22 }$$

To see this, consider first the case t = 0, and consider commuting ${{ \mathcal P }}_{0}\in \{{ \mathcal I },{ \mathcal Z }\}{}^{\otimes n}/{ \mathcal I }$ with all the gates in the circuit. Since all these gates are cX gates with random orientation, the identities

$$\begin{eqnarray}\begin{array}{rcl}{cX}\text{}({Z}_{1}\otimes {I}_{2}) & = & ({Z}_{1}\otimes {I}_{2}){cX}\\ {cX}({I}_{1}\otimes {Z}_{2}) & = & ({Z}_{1}\otimes {Z}_{2}){cX}\\ {cX}({Z}_{1}\otimes {Z}_{2}) & = & ({I}_{1}\otimes {Z}_{2}){cX}\end{array}\end{eqnarray} \tag{ B23 }$$

ensure that every time time that a Pauli-Z error is commuted with a cX, this error becomes another error, chosen at random from two possible ones—figure 9. This can be used to prove that if t = 0, errors in class 4 are detected with probability larger than 1/2. The same considerations apply to the case t = 1, where the identities

$$\begin{eqnarray}\begin{array}{rcl}{cX}({X}_{1}\otimes {I}_{2}) & = & ({X}_{1}\otimes {X}_{2}){cX}\\ {cX}({I}_{1}\otimes {X}_{2}) & = & ({I}_{1}\otimes {X}_{2}){cX}\\ {cX}({X}_{1}\otimes {X}_{2}) & = & ({X}_{1}\otimes {I}_{2}){cX}\end{array}\end{eqnarray} \tag{ B24 }$$

must be used instead of identities B23. □

Zoom In Zoom Out Reset image size

We start by using lemma 1 (appendix 1), which allows to reduce noise of the type N1 to classically correlated single-qubit Pauli errors and to write the joint state of target and trap circuits after all circuits have been implemented (for a fixed choice of single-qubit gates ${{ \mathcal U }}_{j}^{(k)}$) as

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{\mathrm{out}}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)=\displaystyle \sum _{{\overline{s}}^{(1)},\ldots ,{\overline{s}}^{(v+1)}}\ \displaystyle \sum _{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}}\displaystyle \frac{\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)}{{2}^{n(v+1)}}\ \\ \quad \times \,\underset{k=1}{\overset{v+1}{\displaystyle \bigotimes }}\ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{{\overline{s}}^{(k)}}{{ \mathcal P }}_{m}^{(k)}{{ \mathcal U }}_{m}^{(k)}{\circ }_{j=1}^{m-1}\left({ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}^{(k)}{{ \mathcal U }}_{j}^{(k)}\right)\,\circ \,{{ \mathcal P }}_{0}^{(k)}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\left({\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}^{(k)}}\right),\end{array}\end{eqnarray} \tag{ C1 }$$

where ${\rho }_{\mathrm{in}}={\otimes }_{i}| +{\rangle }_{i}\langle +|$, ${\overline{s}}^{(k)}=({s}_{1}^{(k)},\ldots ,{s}_{n}^{(k)})$ is the output of the kth circuit, ${{ \mathcal Z }}^{{\overline{s}}^{(k)}}(\rho )={\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}\rho {Z}_{i}^{{s}_{i}^{(k)}}$, and $\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)$ is the joint probability of a collection of Pauli errors $\{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\}$ affecting the system, with ${{ \mathcal P }}_{1}^{(k)},\ldots ,{{ \mathcal P }}_{m-1}^{(k)}\in \{{ \mathcal I },{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}{}^{\otimes n}$ and ${{ \mathcal P }}_{0}^{(k)},{{ \mathcal P }}_{m}^{(k)}\in \{I,{ \mathcal Z }\}{}^{\otimes n}$ for all k. Summing over all possible choices of single-qubit gates we thus obtain the state of target and traps at the end of the protocol:

$$\begin{eqnarray}\begin{array}{rcl}{\rho }_{\mathrm{out}} & = & \ \displaystyle \sum _{{{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}}\mathrm{prob}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)\ \ {\rho }_{\mathrm{out}}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)\\ & = & \ \displaystyle \sum _{{{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}}\mathrm{prob}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)\displaystyle \sum _{{\overline{s}}^{(1)},\ldots ,{\overline{s}}^{(v+1)}}\ \displaystyle \sum _{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}}\displaystyle \frac{\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)}{{2}^{n(v+1)}}\ \\ & & \times \underset{k=1}{\overset{v+1}{\displaystyle \bigotimes }}\ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{{\overline{s}}^{(k)}}{{ \mathcal P }}_{m}^{(k)}{{ \mathcal U }}_{m}^{(k)}{\circ }_{j=1}^{m-1}\left({ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}^{(k)}{{ \mathcal U }}_{j}^{(k)}\right)\,\circ \,{{ \mathcal P }}_{0}^{(k)}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\left({\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}^{(k)}}\right),\end{array}\end{eqnarray} \tag{ C2 }$$

where $\mathrm{prob}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)$ is the probability of single-qubit gates ${{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}$ being chosen. Crucially, notice that the probability associated to each collection of Pauli errors does not depend on the specific choice of single-qubit gates ${{ \mathcal U }}_{j}^{(k)}$. We can thus rewrite the above state as

$$\begin{eqnarray}\begin{array}{rcl}{\rho }_{\mathrm{out}} & = & \displaystyle \sum _{{\overline{s}}^{(1)},\ldots ,{\overline{s}}^{(v+1)}}\ \displaystyle \sum _{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}}\displaystyle \frac{\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)}{{2}^{n(v+1)}}\ \displaystyle \sum _{{{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}}\mathrm{prob}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)\ \\ & & \times \underset{k=1}{\overset{v+1}{\displaystyle \bigotimes }}\ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{{\overline{s}}^{(k)}}{{ \mathcal P }}_{m}^{(k)}{{ \mathcal U }}_{m}^{(k)}{\circ }_{j=1}^{m-1}\left({ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}^{(k)}{{ \mathcal U }}_{j}^{(k)}\right)\,\circ \,{{ \mathcal P }}_{0}^{(k)}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\left({\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}^{(k)}}\right).\end{array}\end{eqnarray} \tag{ C3 }$$

Consider now the state

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{\mathrm{out}}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)=\displaystyle \sum _{{\overline{s}}^{(1)},\ldots ,{\overline{s}}^{(v+1)}}\ \displaystyle \frac{1}{{2}^{n(v+1)}}\ \displaystyle \sum _{{{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}}\mathrm{prob}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)\\ \quad \times \underset{k=1}{\overset{v+1}{\displaystyle \bigotimes }}\ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{{\overline{s}}^{(k)}}{{ \mathcal P }}_{m}^{(k)}{{ \mathcal U }}_{m}^{(k)}{\circ }_{j=1}^{m-1}\left({ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}^{(k)}{{ \mathcal U }}_{j}^{(k)}\right)\,\circ \,{{ \mathcal P }}_{0}^{(k)}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\left({\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}^{(k)}}\right)\ \ \end{array}\end{eqnarray} \tag{ C4 }$$

corresponding to a fixed collection of Pauli errors $\{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\}$ and assume that the Pauli errors only affect $\widehat{v}\in \{1,\ldots ,v+1\}$ circuits. In this case, as the Pauli errors do not depend on the single-qubit gates, they do not depend on the random number v₀ (which labels the position of the target circuit) nor on the random parameters in the trap circuits. Therefore, summing over all choices of single-qubit gates, the probability that the target is among the $\widehat{v}$ circuits affected by noise is $\widehat{v}/(v+1)$.

Next using lemma 2 (which states that summed over all possible choices of single-qubit gates, trap circuits output $\overline{s}=\overline{0}$ with probability at most 3/4) we have that if $\widehat{v}-1$ trap circuits are affected by noise, they all output $\overline{s}=\overline{0}$ with probability at most ${\left(3/4\right)}^{\widehat{v}-1}$. We thus obtain

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)=\widetilde{b}\ {\widetilde{\tau }}_{\mathrm{out}}^{{\prime} \mathrm{tar}}\otimes {\sigma }_{\overline{s}=\overline{0}}^{\mathrm{trap}}+(1-\widetilde{b})\left(\widetilde{l}\ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes {\sigma }_{\overline{s}=\overline{0}}^{\mathrm{trap}}+(1-\widetilde{l})\ {\widetilde{\tau }}_{\mathrm{out}}^{\mathrm{tar}}\otimes {\sigma }_{\overline{s}\ne \overline{0}}^{\mathrm{trap}}\right),\end{eqnarray} \tag{ C5 }$$

where ${\widetilde{\tau }}_{\mathrm{out}}^{{\prime} \mathrm{tar}}$ (${\sigma }_{\mathrm{out}}^{\mathrm{tar}}$) is the state of the target circuit if the target computation is (is not) among the $\widehat{v}$ traps affected by noise, ${\widetilde{\tau }}_{\mathrm{out}}^{\mathrm{tar}}$ is an arbitrary state for the target, ${\sigma }_{\overline{s}=\overline{0}}^{\mathrm{trap}}$ is the state of the traps when they all output $\overline{s}=\overline{0}$, ${\sigma }_{\overline{s}\ne \overline{0}}^{\mathrm{trap}}$ is an arbitrary state for the traps orthogonal to ${\sigma }_{\overline{s}=\overline{0}}^{\mathrm{trap}}$, $0\leqslant \widetilde{l}\leqslant 1$ and

$$\begin{eqnarray}&&\widetilde{b}\leqslant \displaystyle \frac{\widehat{v}}{v+1}{\left(\displaystyle \frac{3}{4}\right)}^{\widehat{v}-1}.\end{eqnarray} \tag{ C6 }$$

For all $v\geqslant 3$ the RHS of the above upper-bound on $\widetilde{b}$ is maximized by $\widehat{v}=3$, which yields

$$\begin{eqnarray}&&\widetilde{b}\leqslant \mathop{\max }\limits_{\widehat{v}}\displaystyle \frac{\widehat{v}}{v+1}{\left(\displaystyle \frac{3}{4}\right)}^{\widehat{v}-1}=\displaystyle \frac{3}{v+1}{\left(\displaystyle \frac{3}{4}\right)}^{2}=\displaystyle \frac{\kappa }{v+1}{\rm{}}\,,\,{\rm{with}}\kappa \approx \displaystyle \frac{1.7}{v+1}.\end{eqnarray} \tag{ C7 }$$

As this is true for all collections of Pauli errors $\{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\}$, we can sum over all possible collections (weighted by their respective probabilities) and obtain

$$\begin{eqnarray}\begin{array}{rcl}{\rho }_{\mathrm{out}} & = & \displaystyle \sum _{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}}\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)\ \ {\rho }_{\mathrm{out}}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)\\ & = & \ b\ {\tau }_{\mathrm{out}}^{{\prime} \mathrm{tar}}\otimes {\sigma }_{\overline{s}=\overline{0}}^{\mathrm{trap}}+(1-b)\left(l\ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes {\sigma }_{\overline{s}=\overline{0}}^{\mathrm{trap}}+(1-l)\ {\tau }_{\mathrm{out}}^{\mathrm{tar}}\otimes {\sigma }_{\overline{s}\ne \overline{0}}^{\mathrm{trap}}\right)\end{array}\end{eqnarray} \tag{ C8 }$$

with $b\leqslant \kappa /(v+1)$ and $0\leqslant l\leqslant 1$. The theorem is finally proven by replacing the state of the traps with that of the flag bit, namely by replacing ${\sigma }_{\overline{s}=\overline{0}}^{\mathrm{trap}}$ with $| {\rm{acc}}\rangle$ and ${\sigma }_{\overline{s}\ne \overline{0}}^{\mathrm{trap}}$ with $| {\rm{rej}}\rangle$.

D.1. Background

We will now define the notions of protocol and verifiability in the cryptographic setting. We start by defining quantum states as states belonging to the Hilbert space ${{\mathbb{H}}}_{{ABC}}={{\mathbb{H}}}_{A}\otimes {{\mathbb{H}}}_{B}\otimes {{\mathbb{H}}}_{C}$, where ${{\mathbb{H}}}_{A}$ and ${{\mathbb{H}}}_{B}$ are Alice's and Bob's registers and ${{\mathbb{H}}}_{C}$ is a common register used to exchange qubits. The definition of protocol is as follows:

Definition 3 (Protocol). We define a q-step protocol on input ${\rho }_{\mathrm{in}}\in { \mathcal L }({{\mathbb{H}}}_{{ABC}})$ as a series of CPTP maps $\{{{ \mathcal E }}_{{ABC}}^{(p)}\}{}_{p=1}^{q}=\{{{ \mathcal E }}_{{AC}}^{(p)}\circ {{ \mathcal E }}_{{BC}}^{(p)}\}{}_{p=1}^{q}$ yielding the state ${\rho }_{\mathrm{out}}={\circ }_{p=1}^{q}{{ \mathcal E }}_{{ABC}}^{(p)}({\rho }_{\mathrm{in}})$.

In our protocol Alice verifies the correct implementation of the target circuit through the trap circuits. If Bob is honest, all these circuits output a default output and the flag bit is set to $| \mathrm{acc}\rangle \in \{\left|0\right\rangle ,\left|1\right\rangle \}$, otherwise it is likely that they return an incorrect output and the flag bit is set to $| \mathrm{rej}\rangle =| \mathrm{acc}\oplus 1\rangle$. We thus define verifiability as follows:

Definition 4 (Verifiability). Consider a protocol $\{{{ \mathcal E }}_{{ABC}}^{(p)}\}{}_{p=1}^{q}$ on input ${\rho }_{\mathrm{in}}$. The protocol is '${\delta }_{\mathrm{cr}}$-complete' if

$$\begin{eqnarray}&&D\left({\mathrm{Tr}}_{{BC}}\left[{\circ }_{p=1}^{q}{{ \mathcal E }}_{{ABC}}^{(p)}({\rho }_{\mathrm{in}})\right].\,{\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| \right)\leqslant 1-{\delta }_{\mathrm{cr}}{\rm{}}\,,\end{eqnarray} \tag{ D1 }$$

where ${\sigma }_{\mathrm{out}}^{\mathrm{tar}}$ is the correct state of the target at the end of the protocol, $| \mathrm{acc}\rangle$ is the state of the state of the traps indicating acceptance and $0\leqslant {\delta }_{\mathrm{cr}}\leqslant 1$ is called 'completeness'.

The protocol is '${\varepsilon }_{\mathrm{cr}}$-sound' if for any set of CPTP maps $\{{\widetilde{{ \mathcal E }}}_{{BC}}^{(p)}\}{}_{p=1}^{q}$ acting on Bob's register and on the channel, the state in Alice's register at the end of the protocol is

$$\begin{eqnarray}&&D\left({\mathrm{Tr}}_{{BC}}\left[{\circ }_{p=1}^{q}\left({{ \mathcal E }}_{{ABC}}^{(p)}\,\circ \,{\widetilde{{ \mathcal E }}}_{{BC}}^{(p)}\right)({\rho }_{\mathrm{in}})\right],l\ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| +(1-l){\tau }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{rej}\rangle \langle \mathrm{rej}| \right)\leqslant {\varepsilon }_{\mathrm{cr}},\end{eqnarray} \tag{ D2 }$$

where $0\leqslant {\varepsilon }_{\mathrm{cr}}\leqslant 1$ is called 'soundness', $0\leqslant l\leqslant 1$, ${\tau }_{\mathrm{out}}^{\mathrm{tar}}$ is an arbitrary state and $| \mathrm{rej}\rangle$ is orthogonal to $| \mathrm{acc}\rangle$.

We thus model Bob's deviations as arbitrary CPTP maps acting on the system being processed and on Bob's private register.

We can now explain how to translate our protocol in the cryptographic setting.

D.2. Mesothetic protocol

We assume that Alice, the verifier, and Bob, the prover, want to implement interactively a circuit of the type of figure 2, with n qubits, depth m and single-qubit gates $\{{U}_{i,j}\}$. We start by defining the resources required by Alice:

• Alice's resources: a device that can receive n qubits from Bob, apply a single-qubit gate to each of them and send the qubits back to Bob. Alice's device must be able to execute all single-qubit gates contained in the target circuit, together with $H,S,{S}^{\dagger }$ (used in trap circuits) and $X,Y,Z$ (used for the QOTP). We assume that the overall number of these gates is G.

For the protocol to always accept, Bob must possess a quantum computer that can prepare qubits in the $\left|+\right\rangle$ state, execute cZ gates, measure in the Pauli-X basis and store qubits.

We can now explain our protocol, which is formally presented in Box 4 in the Methods. Our protocol takes as input a description of the target circuit and the number v of trap circuits, both inputs also being known to Bob. Steps 1, 2 and 3 are classical and solely involve Alice's register, which at the end of step 3 (for a fixed choice of single-qubit gates ${{ \mathcal U }}_{1}^{{\prime\prime} (1)},\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} (v+1)}$) is in the state

$$\begin{eqnarray}&&{\rho }_{A,\mathrm{in}}\left({{ \mathcal U }}_{1}^{{\prime\prime} (1)},\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} (v+1)}\right)=\left[{\otimes }_{k=1}^{v+1}{\otimes }_{j=1}^{m}{\otimes }_{i=1}^{n}| {U}_{i,j}^{{\prime\prime} (k)}\rangle \langle {U}_{i,j}^{{\prime\prime} (k)}| \right]\otimes \left[{\otimes }_{k=1}^{v+1}{\otimes }_{i=1}^{n}| {\alpha }_{i,m}^{(k)}\rangle \langle {\alpha }_{i,m}^{(k)}| \right].\end{eqnarray} \tag{ D3 }$$

Here, $| {U}_{i,j}^{{\prime\prime} (k)}\rangle$ is a classical description of the gate ${U}_{i,j}^{{\prime\prime} (k)}$. Since Alice's device can execute G different gates, this classical description requires at most log ${}_{2}(G)$ bits. Moreover, $| {\alpha }_{i,m}^{(k)}\rangle$ is a classical description of the bit ${\alpha }_{i,m}^{(k)}$.

In step 4 Alice and Bob interact as follows. For all circuits $k=1,\ldots ,v+1$, in step 4.1 Bob creates n qubits in the state $\left|+\right\rangle$. Then, for each band j = 1,...,m, Bob sends all the qubits to Alice, Alice acts on each qubit i with ${U}_{i,j}^{(k)}$, Alice sends all the qubits back to Bob and Bob implements ${\widehat{{cZ}}}_{j}$. Finally, in step 4.3 Bob measures all the qubits and returns the outputs to Alice. The random but ${\alpha }_{i,m}^{(k)}$ coming from the QOPT in the last round of single-qubit gates bit-flips the outputs, therefore Bob transmits to Alice the bits ${s}_{i}^{(k)}\oplus {\alpha }_{i,m}^{(k)}$. Alice post-processes those bits and obtains ${s}_{i}^{(k)}$. At the end of step 4, the states in Alice and Bob's registers (if Bob is honest) are of the form

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{A,\mathrm{out}}\left({{ \mathcal U }}_{1}^{{\prime\prime} (1)},\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} (v+1)}\right)=\left[{\otimes }_{k=1}^{v+1}{\otimes }_{j=1}^{m}{\otimes }_{i=1}^{n}| {U}_{i,j}^{{\prime\prime} (k)}\rangle \langle {U}_{i,j}^{{\prime\prime} (k)}| \right]\otimes \left[{\otimes }_{k=1}^{v+1}{\otimes }_{i=1}^{n}| {s}_{i}^{(k)}\rangle \langle {s}_{i}^{(k)}| \right]\\ {\rho }_{B,\mathrm{out}}={\otimes }_{k=1}^{v+1}{\otimes }_{i=1}^{n}{Z}_{i}^{{s}_{i}^{(k)}\oplus {\alpha }_{i,m}^{(k)}}| +{\rangle }_{i}^{(k)}\langle +| {Z}_{i}^{{s}_{i}^{(k)}\oplus {\alpha }_{i,m}^{(k)}}.\end{array}\end{eqnarray} \tag{ D4 }$$

The protocol ends with Alice checking whether the traps yield the correct output and setting the flag bit to $| \mathrm{acc}\rangle$ or $| \mathrm{rej}\rangle$.

We will now prove completeness and soundness for our mesothetic protocol (we refer the reader to the beginning of the appendix for notation). We begin with the assumption that Alice's device is noiseless. Soundness requires the following Lemmas:

Lemma D1. Suppose that Alice's device is noiseless. For a fixed choice of single-qubit gates ${{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}$ by Alice, tracing out Bob's private register and summing over all the random bits ${\alpha }_{i,j}^{(k)},{\alpha }_{i,j}^{{\prime} (k)},{\gamma }_{i}^{(k)}$ except ${\alpha }_{i,m}^{(k)}$ (see Routine 1), the state in Bob's register at the end of the protocol is of the form

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{B,\mathrm{out}}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)=\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{{\overline{s}}^{(1)},\ldots ,{\overline{s}}^{(v+1)}}{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}}}\displaystyle \frac{\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)}{{2}^{n(v+1)}}\ \\ \quad \underset{k=1}{\overset{v+1}{\displaystyle \bigotimes }}\ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{{\overline{s}}^{(k)}}{{ \mathcal P }}_{m}^{(k)}{{ \mathcal U }}_{m}^{(k)}{\circ }_{j=1}^{m-1}\left({ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}^{(k)}{{ \mathcal U }}_{j}^{(k)}\right)\,\circ \,{{ \mathcal P }}_{0}^{(k)}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\times \left({\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}\oplus {\alpha }_{i,m}^{(k)}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}^{(k)}\oplus {\alpha }_{i,m}^{(k)}}\right){\rm{}}\,,\end{array}\end{eqnarray} \tag{ D5 }$$

where ${\rho }_{\mathrm{in}}={\otimes }_{i}| +{\rangle }_{i}\langle +|$, ${\overline{s}}^{(k)}=({s}_{1}^{(k)},\ldots ,{s}_{n}^{(k)})$ is the output of the kth circuit, ${{ \mathcal Z }}^{{\overline{s}}^{(k)}}(\rho )={\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}\rho {Z}_{i}^{{s}_{i}^{(k)}}$ and $\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)$ is the joint probability of a collection of Pauli errors ${{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}$ affecting the system, with ${{ \mathcal P }}_{1}^{(k)},\ldots ,{{ \mathcal P }}_{m-1}^{(k)}\in \{{ \mathcal I },{ \mathcal X },{ \mathcal Y },{ \mathcal Z }\}{}^{\otimes n}$ and ${{ \mathcal P }}_{0}^{(k)},{{ \mathcal P }}_{m}^{(k)}\in \{{ \mathcal I },{ \mathcal Z }\}{}^{\otimes n}$ for all k.

Proof. (Sketch) We start proving the lemma for a protocol with a single circuit (v = 1), next we generalize to $v\gt 1$. For a fixed choice of gates ${U}_{i,j}^{{\prime\prime} }$ by Alice, the joint state of Alice's register A and Bob's register B before the final measurements is of the form

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{{AB}}\left({{ \mathcal U }}_{1}^{{\prime\prime} (1)},\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} (v+1)}\right)=\ \left[{\otimes }_{j=1}^{m}{\otimes }_{i=1}^{n}| {U}_{i,j}^{{\prime\prime} }\rangle \langle {U}_{i,j}^{{\prime\prime} }| \right]\otimes \left[{\otimes }_{k=1}^{v+1}{\otimes }_{i=1}^{n}| {\alpha }_{i,m}\rangle \langle {\alpha }_{i,m}| \right]\otimes \ \ {\rm{(Alice\mbox{'}s}}\,{\rm{register)}}\\ \quad \left[{\widetilde{{ \mathcal E }}}_{m}{{ \mathcal U }}_{m}^{{\prime\prime} }\,\circ \,\left({\circ }_{j=1}^{m-1}{\widetilde{{ \mathcal E }}}_{j}{{ \mathcal U }}_{j}^{{\prime\prime} }\right)\,\circ \,{{ \mathcal E }}_{0}\left({\rho }_{\mathrm{in}}^{}\right)\right].\ \ \ \ \ \ \ \ \ \ \ \ \ {\rm{(Bob\mbox{'}s}}\,{\rm{register)}},\end{array}\end{eqnarray} \tag{ D6 }$$

where ${\widetilde{{ \mathcal E }}}_{j}$ are Bob's deviations. Specifically, ${\widetilde{{ \mathcal E }}}_{0}$ is Bob's deviation when he prepares ${\rho }_{\mathrm{in}}$ (step 4.1), for all $j=1,\ldots ,m-1$, ${\widetilde{{ \mathcal E }}}_{j}$ is Bob's deviations when in step 4.2 he should execute ${\widehat{{cZ}}}_{j}$, ${\widetilde{{ \mathcal E }}}_{m}$ is Bob's deviation before he measures the qubits (step 4.3). Without loss of generality, suppose now that Bob holds another register, which we call 'ancillary register' and denote with ${B}_{\mathrm{anc}}$. Tensoring ${\rho }_{\mathrm{in}}$ with the state ${\sigma }_{\mathrm{anc}}$ in the register ${B}_{\mathrm{anc}}$, for $j\in \{1,\ldots ,m-1\}$ we can rewrite Bob's deviations ${\widetilde{{ \mathcal E }}}_{j}$ as unitaries ${{\bf{F}}}_{j}{\widehat{{cZ}}}_{j}$, where ${{\bf{F}}}_{j}$ is a unitary matrix that acts on Bob's register B and on ${B}_{\mathrm{anc}}$—for convenience we indicate unitary matrices acting both on Bob's register B and on ${B}_{\mathrm{anc}}$ in bold font. Similarly, we can replace ${\widetilde{{ \mathcal E }}}_{0}$ with the unitary ${\bf{R}}$ and ${\widetilde{{ \mathcal E }}}_{m}$ with the unitary ${\bf{M}}$. We thus obtain

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{{{ABB}}_{\mathrm{anc}}}\left({{ \mathcal U }}_{1}^{{\prime\prime} (1)},\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} (v+1)}\right)=\ \left[{\otimes }_{j=1}^{m}{\otimes }_{i=1}^{n}| {U}_{i,j}^{{\prime\prime} }\rangle \langle {U}_{i,j}^{{\prime\prime} }| \right]\otimes \left[{\otimes }_{k=1}^{v+1}{\otimes }_{i=1}^{n}| {\alpha }_{i,m}\rangle \langle {\alpha }_{i,m}| \right]\,\\ \quad \left[\otimes ,\,,[,{\bf{M}}\ {U}_{m}^{{\prime\prime} }{{\bf{F}}}_{m-1}{\widehat{{cZ}}}_{m-1}^{}{U}_{m-1}^{{\prime\prime} }\ldots {{\bf{F}}}_{1}{\widehat{{cZ}}}_{1}^{}{U}_{1}^{{\prime\prime} }{\bf{R}}\left({\rho }_{\mathrm{in}}\otimes {\sigma }_{\mathrm{anc}}\right){{\bf{R}}}^{\dagger }{U}_{1}^{{\prime\prime} \dagger }{\widehat{{cZ}}}_{1}{{\bf{F}}}_{1}^{\dagger }\ldots {U}_{m-1}^{{\prime\prime} \dagger }{\widehat{{cZ}}}_{m-1}{{\bf{F}}}_{m-1}^{\dagger }{U}_{m}^{{\prime\prime} \dagger }{{\bf{M}}}^{\dagger }\right].\end{array}\end{eqnarray} \tag{ D7 }$$

Tracing out Alice's register and ${B}_{\mathrm{anc}}$ yields

$$\begin{eqnarray}&&\begin{array}{l}{\mathrm{Tr}}_{{{AB}}_{\mathrm{anc}}}\left[{\rho }_{{{ABB}}_{\mathrm{anc}}}\left({{ \mathcal U }}_{1}^{{\prime\prime} (1)},\ldots ,{{ \mathcal U }}_{m}^{{\prime\prime} (v+1)}\right)\right]\\ \quad =\,{\mathrm{Tr}}_{{B}_{\mathrm{anc}}}\left[{\bf{M}}\ {U}_{m}^{{\prime\prime} }{{\bf{F}}}_{m-1}{\widehat{{cZ}}}_{m-1}^{}{U}_{m-1}^{{\prime\prime} }\ldots {{\bf{F}}}_{1}{\widehat{{cZ}}}_{1}^{}{U}_{1}^{{\prime\prime} }{\bf{R}}\left({\rho }_{\mathrm{in}}\otimes {\sigma }_{\mathrm{anc}}\right){{\bf{R}}}^{\dagger }{U}_{1}^{{\prime\prime} \dagger }{\widehat{{cZ}}}_{1}{{\bf{F}}}_{1}^{\dagger }\ldots {U}_{m-1}^{{\prime\prime} \dagger }{\widehat{{cZ}}}_{m-1}{{\bf{F}}}_{m-1}^{\dagger }{U}_{m}^{{\prime\prime} \dagger }{{\bf{M}}}^{\dagger }\right].\end{array}\end{eqnarray} \tag{ D8 }$$

This state is equal to the state ρ in equation (A4), provided that we replace ${\sigma }_{\mathrm{anc}}$ with ${\rho }_{E}$ and ${\mathrm{Tr}}_{{B}_{\mathrm{anc}}}$ with Tr ${\mathrm{Tr}}_{E}[\cdot ]$, hence the lemma can be proven repeating the same calculations. The reader can verify that the same applies to the case v > 1. □

Lemma D2. For any collection of Pauli errors affecting a trap circuit, summing over all possible single-qubit gates in the trap circuit (i.e. over all possible sets $\{{U}_{i,j}\}$ output by Routine 2), the probability that the trap circuit outputs $\overline{s}=\overline{0}$ is at most 3/4.

As Alice choses all the gates in a trap circuits with Routine 2, the proof is the same as that of lemma 2. Using these two lemmas we now compute the classical state in Alice's register after all the circuits have been implemented:

Lemma D3. Suppose that Alice's device is noiseless. Then, for any number $v\geqslant 3$ of trap computations, the state in Alice's register at the end of the protocol is of the form (see definition 4 for notation)

$$\begin{eqnarray}&&{\rho }_{\mathrm{out}}=b\ {\tau }_{\mathrm{out}}^{{\prime} \mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| +(1-b)\left(l\ \ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| +(1-l){\tau }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{rej}\rangle \langle \mathrm{rej}| \right){\rm{}}\,,\end{eqnarray} \tag{ D9 }$$

where ${\tau }_{\mathrm{out}}^{{\prime} \mathrm{tar}}$ is an incorrect state for the target, $0\leqslant b\leqslant \kappa /(v+1)$ and $\kappa =3{\left(3/4\right)}^{2}\approx 1.7$.

Proof. After Bob has implements all the circuits and communicates all the outputs to Alice, Alice holds the same classical state as Bob (equation (D5)). After Alice post-processes the outputs this state becomes (see Lemma D1 for notation)

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{A,\mathrm{out}}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)=\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{{\overline{s}}^{(1)},\ldots ,{\overline{s}}^{(v+1)}}{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}}}\displaystyle \frac{\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)}{{2}^{n(v+1)}}\ \\ \quad \underset{k=1}{\overset{v+1}{\displaystyle \bigotimes }}\ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{{\overline{s}}^{(k)}}{{ \mathcal P }}_{m}^{(k)}{{ \mathcal U }}_{m}^{(k)}{\circ }_{j=1}^{m-1}\left({ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}^{(k)}{{ \mathcal U }}_{j}^{(k)}\right)\,\circ \,{{ \mathcal P }}_{0}^{(k)}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\times \left({\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}^{(k)}}\right){\rm{}}\,.\end{array}\end{eqnarray} \tag{ D10 }$$

Crucially, notice that the probability associated to each deviation ${{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}$ does not depend on the choice of single-qubit gates made by Alice. Thus, summing over all choices of single-qubit gates, this state becomes

$$\begin{eqnarray}&&\begin{array}{l}{\rho }_{A,\mathrm{out}}=\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{{\overline{s}}^{(1)},\ldots ,{\overline{s}}^{(v+1)}}{{{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}}}\displaystyle \frac{\mathrm{prob}\left({{ \mathcal P }}_{1}^{(1)},\ldots ,{{ \mathcal P }}_{m}^{(v+1)}\right)}{{2}^{n(v+1)}}\ \displaystyle \sum _{{{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}}\mathrm{prob}\left({{ \mathcal U }}_{1}^{(1)},\ldots ,{{ \mathcal U }}_{m}^{(v+1)}\right)\\ \quad \underset{k=1}{\overset{v+1}{\displaystyle \bigotimes }}\ \langle +{| }^{\otimes n}\left[{{ \mathcal Z }}^{{\overline{s}}^{(k)}}{{ \mathcal P }}_{m}^{(k)}{{ \mathcal U }}_{m}^{(k)}{\circ }_{j=1}^{m-1}\left({ \mathcal C }{{ \mathcal Z }}_{j}{{ \mathcal P }}_{j}^{(k)}{{ \mathcal U }}_{j}^{(k)}\right)\,\circ \,{{ \mathcal P }}_{0}^{(k)}\left({\rho }_{\mathrm{in}}\right)\right]| +{\rangle }^{\otimes n}\times \left({\otimes }_{i}{Z}_{i}^{{s}_{i}^{(k)}}| +{\rangle }_{i}\langle +| {Z}_{i}^{{s}_{i}^{(k)}}\right){\rm{}}\,.\end{array}\end{eqnarray} \tag{ D11 }$$

The lemma can now be proven following the same steps as in the proof of theorem 1. □

Using these three lemmas we can now calculate completeness and soundness for the mesothetic protocol and obtain theorem D1:

Theorem D1. Suppose that Alice's device is noiseless. Then, for any number $v\geqslant 3$ of trap circuits, the mesothetic protocol is verifiable with

$$\begin{eqnarray}&&{\delta }_{\mathrm{cr}}=1\ \mathrm{and}\ {\varepsilon }_{\mathrm{cr}}=\displaystyle \frac{\kappa }{v+1},\end{eqnarray} \tag{ D12 }$$

where $\kappa =3{\left(3/4\right)}^{2}\approx 1.7.$

Proof. Completeness can be proven trivially showing that for all circuits, the random Pauli gates used for the QOTP cancel between them, and that the effects of the QOTP in the last band are recovered by the classical post-processing made by Alice. Therefore, all the circuits implement the desired computation, and a correctly implemented protocol yields the correct output for the target and the state of the traps indicating acceptance.

To prove soundness we need to compute the trace distance in equation (D2). Using lemma D3 this trace distance becomes

$$\begin{eqnarray}&&\begin{array}{l}D\left(b\ {\tau }_{\mathrm{out}}^{{\prime} \mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| +(1-b)\left[l\ \ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| +(1-l){\tau }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{rej}\rangle \langle \mathrm{rej}| \right],l\ {\sigma }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{acc}\rangle \langle \mathrm{acc}| \right.\\ \quad \left.+\,(1-l){\tau }_{\mathrm{out}}^{\mathrm{tar}}\otimes | \mathrm{rej}\rangle \langle \mathrm{rej}| \right)\leqslant b\end{array}\end{eqnarray} \tag{ D13 }$$

and since $b\leqslant \kappa /(v+1)$ by lemma D3, we obtain soundness ${\varepsilon }_{\mathrm{cr}}=\kappa /(v+1)$.□

We can also compute completeness and soundness in the case where Alice's device suffers bounded and potentially gate-dependent noise:

Theorem D2. Suppose that Alice's device is affected by bounded noise, i.e. that for all circuits $k\in \{1,\ldots ,v+1\}$ and bands $j\in \{1,\ldots ,m\}$ she applies ${{ \mathcal E }}_{j}^{(k)}{U}_{j}^{(k)}$, where ${{ \mathcal E }}_{j}^{(k)}=(1-{r}_{j}^{(k)}){ \mathcal I }+{r}_{j}^{(k)}{{ \mathcal E }}_{j}^{{\prime} \ (k)}$ for some arbitrary CPTP-map ${{ \mathcal E }}_{j}^{{\prime} \ (k)}$ and number $0\leqslant {r}_{j}^{(k)}\lt 1$. Then, for any number $v\geqslant 3$ of trap computations, the mesothetic protocol is verifiable with

$$\begin{eqnarray}&&{\delta }_{\mathrm{cr}}=1\ \mathrm{and}\ {\varepsilon }_{\mathrm{cr}}=g\displaystyle \frac{\kappa }{v+1}+\ 1\ -g{\rm{}}\,,\end{eqnarray} \tag{ D14 }$$

where $\kappa =3{\left(3/4\right)}^{2}\approx 1.7$, $g={\prod }_{j,k}1-{r}_{\max ,j}^{(k)}$ and ${r}_{\max ,j}^{(k)}$ is the maximum error rate of the round of gates in band j of circuit k, where this maximum is taken over all choices gates for this round.

Proof. The proof of completeness is the same as for theorem D1. To compute soundness, we denote as ${\rho }_{\mathrm{out}}^{\star }$ the state in Alice's register at the end of a protocol run when Alice's device is noisy, and as ${\rho }_{\mathrm{out}}$ the state in Alice's register at the end of a protocol run when Alice's device is noiseless (Lemma D3). Indicating as ${r}_{\max ,j}^{(k)}$ the maximum error rate for gates in band j, we rewrite this noisy map as ${{ \mathcal E }}_{j}^{(k)}=(1-{r}_{\max ,j}^{(k)})I+{r}_{\max ,j}^{(k)}{{ \mathcal Q }}_{j}^{(k)}$ for some other CPTP map ${{ \mathcal Q }}_{j}^{(k)}$. This allows to rewrite the classical state in Alice's register at the end of the protocol as $g{\rho }_{\mathrm{out}}+(1-g){\rho }_{\mathrm{out}}^{\star }$ and to obtain the upper-bound the trace distance. □

We conclude this appendix by showing how our protocol can be made blind. Blindness is a property exhibited by many cryptographic protocols [25] defined as follows:

Definition 5 (Blindness). A protocol $\{{{ \mathcal E }}_{{ABC}}^{(p)}\}=\{{{ \mathcal E }}_{{AB}}^{(p)}\otimes {{ \mathcal E }}_{{BC}}^{(p)}\}$ on input ${\rho }_{\mathrm{in}}$ is blind if for any set of maps $\{{\widetilde{{ \mathcal E }}}_{{BC}}^{(p)}\}$ acting on Bob's register and on the channel, the state in Bob's register at the end of the protocol leaks at most a constant function of the input.

Typically blind cryptographic protocols leak an upper-bound on the size of the target circuit.

As introduced above, our mesothetic protocol is not blind. Indeed, Bob has access to non-trivial information about the target circuit, such as the position of cZ gates. This is not a problem for our scopes, as verifiability only relies on Bob's ignorance of the number v₀, which is kept secret by Alice with the QOTP. Nevertheless, blindness may be required for maintaining the privacy of the users in future scenarios of delegated computations, thus it is important to understand whether our protocol can be turned into a blind protocol.

To obtain blindness, Alice (endowed with an ideal device) must recompile the target circuit into a normal form, for instance by recompiling the target circuit into a circuit of the type illustrated in figure 6 (which inspired to Brickwork States [52]). Then, instead of giving as input to the mesothetic protocol a classical description of the target circuit, she only needs to input the desired size of the circuit in normal form (n qubits, depth m).

Implementing target and traps on a circuit in normal form makes Alice's instructions to Bob independent from the specific target circuit that Alice wishes to verify. This allows to prove blindness:

Theorem D3 (Blindness with Circuit in Normal Form). Suppose that Alice can apply noiseless single-qubit gates. If Alice rewrites the target circuit in normal form, the mesothetic protocol (with input the desired size of the circuit in normal form) only leaks an upper-bound on the size of the target circuit.

Proof. To prove blindness we notice that during the protocol run Bob cannot retrieve any information about the the target circuit. Indeed, Bob's tasks are the same for all circuits (prepare the same input state, execute the same entangling gates and measure in the same basis) and these tasks do not depend on the target circuit, since this target is implemented on a circuit in normal form. Moreover, the only type of information that Bob receives from Alice during the implementation of the circuits are the qubits at step 4.2.1, but the QOTP prevents Bob from retrieving useful information: at any $k=1,\ldots ,v+1$ and j = 1,...,m, if Bob sends to Alice a state ${\rho }_{j}^{(k)}$, Alice returns to him the state

$$\begin{eqnarray}&&{U}_{j}^{{\prime\prime} (k)}{\rho }_{j}^{(k)}{U}_{j}^{\dagger ^{\prime\prime} (k)}={\otimes }_{i=1}^{n}{Z}^{{\alpha }_{i,j}^{(k)}}{X}^{{\alpha }_{i,j}^{{\prime} (k)}}\left[{U}_{j}^{(k)}{P}_{j-1}{\rho }_{j}^{(k)}{P}_{j-1}{U}_{j}^{\dagger (k)}\right]{X}^{{\alpha }_{i,j}^{{\prime} (k)}}{Z}^{{\alpha }_{i,j}^{(k)}},\end{eqnarray} \tag{ D15 }$$

where ${P}_{j-1}$ is the Pauli operator that undoes previous QOTP. Summing over all possible ${\alpha }_{i,j}^{(k)}$ and ${\alpha }_{i,j}^{{\prime} (k)}$ yields the completely mixed state. □